The Vendor Risk Management (VRM) module in KnowBe4's KCM GRC platform lets you centralize your third-party risk management processes. You can prequalify risk, assess your vendors, and conduct remediation efforts all in one platform. The VRM module is available to Platinum subscriptions.

As part of working in the VRM module, you can create a "vendor profile" for each of the internal or external third parties that you will be working with. Then, you can use vendor profiles to send questionnaire assessments and to work through any issues that may arise from assessment responses. From vendor profiles, you can also modify vendor scores and create risks for vendors. 

See the sections below to learn about creating new vendor profiles, adding vendor contacts, and working with vendor profiles in your KCM GRC account.

Vendors Page

You will create vendor profiles from the Vendors area of your VRM module. The Vendors page serves as a repository of the vendor profiles you have added to your account. To navigate to this page, from the navigation panel, click Vendor Management > Vendors. 

Much of your VRM workflow will be carried out through vendor profiles, for example:

• Adding user accounts for vendor contacts
• Sending questionnaires
• Reviewing questionnaires
• Creating issues for questionnaire responses
• Communicating with vendors about questionnaire issues
• Closing questionnaire issues

Once you've added vendor profiles to your account, your Vendors page will look similar to the image below.

1. The Name column displays the third-party organization's name. Click on the name of the organization to open their vendor profile.
2. The Contact Name will be the name of your primary contact at the third-party company
3. The Status of the vendor profile can be any of the following: Active, Inactive, Pending Approval, Rejected, Incomplete. 
4. You'll select the vendor Type when creating the vendor profile. The vendor type will be Internal or External.
5. The vendor Score is calculated after the vendor has completed one or more questionnaire assessments. For more information about vendor scores, see the Working With Vendor Profiles section below.
6. The Data Categories represent the types of data that the vendor will store, process, or transmit in order to carry out operations for your organization. You'll add these data types when creating a vendor profile. For details, see the Organization Contact Details section below.

Adding New Vendor Profiles

Before you begin sending questionnaires to your vendors, you'll create vendor profiles under the Vendors area of the VRM module. By adding contact information and other details relevant to business operations, the vendor profile helps you prequalify the level of risk associated with each third party.

To create a vendor profile, you'll start by adding the Organization Contact Details, then you'll answer Qualifying Questions to prequalify the level of risk associated with each third-party or vendor. Before you can send questionnaires to your vendors, you'll create user accounts for the individuals who are responsible for completing your questionnaire assessments. Follow the next subsections below to complete the vendor onboarding process in your VRM module:

Organization Contact Details

From the navigation panel, navigate to the Vendors tab. Then, either import a CSV file containing the contact details for one or more vendors, or add vendors individually to your platform.

To upload the contact details by importing a CSV file, see our How Do I Import Vendors into My Account with a CSV File? article. 

To add the contact details for vendors individually, click the Create New Vendor button from the Vendors page. Then, add information to the fields outlined below.

1. Name: (Required) The name of the vendor or third party that you are working with or sending assessments to. 
2. Contact Name: (Required) The name of the primary person/contact you will be working with for questionnaire assessments. 
3. Contact Email: (Required) The email address of the person you've listed for the Contact Name, above.
   Important: The email address you enter for the Contact Email is where the automatic email notifications will be sent when you assign a questionnaire to your vendor. Before you can assign a questionnaire, you will need to create a user account for your vendor contact. See the Adding User Accounts for Vendor Contacts section below for details.
4. Telephone: The telephone number for either the organization or for the primary vendor contact at the organization. 
5. Website: The web address for the vendor or third party. 
6. Vendor Type: Select Internal or External. For example, an internal vendor may be a contracted business unit that provides services to your organization, while an external vendor is one outside of your organization.
7. Industry: Select the vendor's industry from the drop-down menu.
8. Street Address: Use this and the remaining fields to add the vendor or third party's address.
9. State/Province/Region: Enter the state, province, or region for the vendor or third party. If you select United States for the country, this field will change to a drop-down menu that you can use to select the state. If you select Canada for the country, this field will change to a drop-down menu that you can use to select the province. 
10. Zip/Postal Code: Enter the zip code or postal code for the vendor or third party. 
11. Data Types: Select all applicable categories of data that your vendor will store, process, or transmit in order to carry out operations for your organization. If the listed data types are not applicable, select Other. Click the drop-down below for details about the data types.
    Vendor Details: Data Types

    Acronym	Data Type	Description
    CHD	Cardholder Data	Information related to a cardholder, including the cardholder's name and their card's expiration date, primary account number, and service code.
    CPI	Client Privileged Information	Any information that is considered confidential communication between an attorney and their client.
    CUI	Controlled Unclassified Information	Federal, non-classified information that must be safeguarded by adhering to security requirements and controls designed to secure sensitive information.
    ECR	Export Controlled Research	Includes any information that is regulated for reasons of national security, foreign policy, anti-terrorism, or non-proliferation. This includes ITAR and EAR data types.
    FERPA	Family Educational Rights and Privacy Act	This act governs access to and the release of student education records.
    FISMA	Federal Information Security Management Act	This act requires federal agencies and any contracted parties to develop, document, and implement an information security and protection program for federal data.
    GLBA	Gramm Leach Bliley Act	This act requires financial institutions to explain how they share and protect their customers' sensitive data.
    PHI	Protected Health Information	Under HIPAA, protected health information is considered to be individually identifiable information relating to the past, present, or future health status of an individual that is created, collected, transmitted, or maintained by a HIPAA-covered entity in relation to the provision of healthcare, payment for healthcare services, or use in healthcare operations.
    IT	Information Technology (Security Information)	Information pertaining to safeguarding organizational IT resources.
    PCI	Payment Card Industry	Information pertaining to storing, processing, or transmitting credit card, debit card, or any other type of payment card data.
    PII	Personally Identifiable Information	Sensitive data that could potentially identify a specific individual.

12. Details of Services/Goods: You can optionally add details about the vendor in this field.

Next, you can answer qualifying questions about the vendor. For more information, see the Qualifying Questions section below.

Qualifying Questions

Under the Organization Contact Details section, you can answer qualifying questions to help you assess the level of risk that is associated with working with the vendor. 

You can either answer the qualifying questions as you're creating your new vendor or answer the questions at a later time by navigating to the vendor's Vendor Details page. You can navigate to the Vendor Details page by selecting the Vendor tab (Vendor Management > Vendors) and clicking the vendor name under the Name column.

After you finish filling out the information for a vendor, click the Create button to create the vendor's profile.

Adding User Accounts for Vendor Contacts

Once you're ready to send a questionnaire to a vendor, you'll add a user account in KCM GRC for the appropriate person so they can complete the questionnaire. This user will log in to a separate vendor portal that is associated with your account. This vendor portal is specifically for the vendor contact to answer their assigned questionnaires and to address issues that may arise from questionnaire responses.

Follow the steps below to add a vendor user account to your console:

1. Navigate to the vendor profile by clicking Vendor Management > Vendors from the navigation panel, then click the third-party organization's name from the Name column.
2. From the Vendor Details page, click the Contacts tab (shown below), then click the Create Vendor Contact button on the right-hand side.
3. Fill out the user information, then click the Create button.
   Note: The email address that you use to create the vendor contact should also be listed in the Contact Email field on the Organization Details area of the page. The email address in the Contact Email field is where the automatic email notifications are sent when you assign a questionnaire to your vendor.
   Tip: You can add multiple contacts to one vendor profile. All contacts that are listed under the Contacts tab are able to log in to the vendor's portal and they can access the questionnaires and issues that you've assigned to this vendor.

See our How to Create and Manage KCM GRC User Accounts article for more information about creating users. For more information on sending questionnaire assessments, see our How to Create and Configure Questionnaires article.

Working With Vendor Profiles (Vendor Details)

This section and the following subsections provide information about the Vendor Details page and the workflows that you can carry out from your vendor profiles. 

To learn about working with vendor profiles from the Vendors Details page, see the list below. 

1. Update: Click this button to edit any of the information shown on the Vendor Details page.
2. Archive: Click this button to archive the vendor profile. Archiving the vendor will automatically disable any Vendor Users listed under the Contacts tab in the vendor profile. This option may be helpful if you will be working with the vendor at a later time. Note, if a vendor profile is archived you will not be able to create a new vendor profile with the same name.
3. Delete: Click this button to fully delete the vendor profile and all associated data. Only Account Administrators have access to this button. All iterations of questionnaires that were sent to or completed by this vendor will be deleted. Deleting the vendor will also automatically disable any Vendor Users listed under the Contacts tab of the vendor profile. This action cannot be undone.
4. Vendor Score: This percentage is calculated once the vendor contact has completed and finalized one or more questionnaire assessments. Vendor scores range from 0 percent to 100 percent. The vendor score is the average score for all questionnaires that the vendor has completed. Generally, higher vendor scores indicate that the vendor has a lower risk level, and lower vendor scores indicate that the vendor has a higher risk level. If you'd like, you can manually change a vendor score from a vendor's vendor profile. To learn how to modify a vendor score, see the Modifying Vendor Scores section below. 
5. Create Risk for Vendor: To learn about creating a risk for a vendor, see the Creating Risks for Vendors section below.
6. Notes: Use this widget to communicate information about the vendor to other KCM GRC users. For example, if you create a risk for a vendor, you can enter a note about the risk into the Notes widget. 

Modifying Vendor Scores

Follow the steps below to offset the vendor score for a vendor profile.

1. Click the Update button at the top of the Vendor Details page.
2. Then, use the Vendor Score Offset field (shown above) to enter any integer between -100 and 100. For example, if the original vendor score is 89.4% and you enter "-3" in the Vendor Score Offset field, the adjusted vendor score will be 86.4%.
3. You can optionally leave a note explaining why you are offsetting the vendor score in the Vendor Score Adjustment Note field. 
4. Click the Save button to save the offset percentage.

The adjusted vendor score will be displayed in the vendor profile along with the original vendor score that was calculated by KCM.

Creating Risks for Vendors

As you assess a vendor or third party with questionnaires, you can monitor the vendor's vendor score to determine the amount of risk that working with the vendor poses for your organization. Then, you can create a risk for the vendor so that you can work towards mitigating the risk from your Risk Management module.  

To create a risk for a vendor, follow the instructions below. 

1. From your navigation panel, navigate to the Vendors tab (Vendor Management > Vendors).
2. Select a vendor under the Name column
3. In the Organization Details section of the page, click the Create Risk for Vendor button. 
4. Fill out the field on the Create Risk for Vendor page. To learn more about these fields, see the Create Individual Risks section of our How to Use Your Risk Register article. 
5. Click the Save button. 

After you create the risk for a vendor, the risk will appear in your Risk Register. 

Vendor Workflows

Click on the tabs below to learn about the workflows you'll carry out from the tabs found on Vendor Details pages (vendor profiles), under your VRM module.