Working With Vendor Profiles in KCM GRC

The Vendor Risk Management (VRM) module in KnowBe4's KCM Governance, Risk, and Compliance (GRC) platform lets you centralize your third-party risk management processes. You can prequalify risk, assess your vendors, and conduct remediation efforts all in one platform. The VRM module is available to Platinum subscriptions.

As part of working in the VRM module, you will create a "vendor profile" for each of the internal or external third-parties that you will be working with. The vendor profile helps you prequalify the level of risk associated with the third-party. You'll then use vendor profiles to send questionnaire assessments and to work through any issues that may arise from assessment responses.

See the sections below to learn about creating new vendor profiles, adding vendor contacts (vendor users), and working in vendor profiles in your KCM GRC account.

Jump to:

The Vendors Page

Adding New Vendor Profiles

• Organization Contact Details
• Qualifying Questions
• Adding User Accounts for Vendor Contacts

Working With Vendor Profiles (Vendor Details)

The Vendors Page

Vendor profiles are found under the Vendors area of your VRM module. This page serves as a repository of the vendor profiles you have added to your account. To navigate to this page, from the navigation panel, click Vendor Management > Vendors. 

Much of your VRM workflow will be carried out through vendor profiles, for example:

• Adding user accounts for vendor contacts
• Sending questionnaires
• Reviewing questionnaires
• Creating issues for questionnaire responses
• Communicating with vendors about questionnaire issues
• Closing questionnaire issues

Once you've added vendor profiles to your account, your Vendors page will look similar to the image below.

1. The Name column displays the third-party organization's name. Click on the name of the organization to open their vendor profile.
2. The Contact Name will be the name of your primary contact at the third-party company
3. The Status of the vendor profile can be any of the following: Active, Inactive, Pending Approval, Rejected, Incomplete. Vendor profiles must be in Active status before you can send questionnaire assessments to this vendor.
4. You'll select the vendor Type when creating the vendor profile. The vendor type will be Internal or External.
5. The vendor Score is calculated after the vendor has completed one or more questionnaire assessments. For more information about vendor score, see the Working With Vendor Profiles section, below.
6. The Data Categories represent the types of data that the third-party will store, process, or transmit in order to carry out operations for your organization. You'll add the data types when creating the vendor profile. For details, see the Organization Contact Details section, below.

See the next section to learn more about adding new vendors to your account.

Back to top

Adding New Vendor Profiles

Before you begin sending questionnaires to your vendors, you'll create vendor profiles under the Vendors area of the VRM module. By adding contact information and other details relevant to business operations, the vendor profile helps you prequalify the level of risk associated with each third-party.

To create a vendor profile, you'll start by adding the Organization Contact Details, then you'll answer Qualifying Questions to prequalify the level of risk associated with each third-party or vendor. Before you can send questionnaires to your vendors, you'll create user accounts for the individuals who are responsible for completing your questionnaire assessments.

Follow the next three sections to complete the vendor onboarding process in your VRM module:

• Organization Contact Details
• Qualifying Questions 
• Adding User Accounts for Vendor Contacts

Organization Contact Details

1. Navigate to the Vendors page. From the navigation panel, click Vendor Management, then click Vendors.
2. You have two options for adding the organization's contact details. You can either import a CSV file or add the information directly to your console:
   • To upload the contact details, click the Import Vendor CSV button from the Vendors page. The CSV file should have the following header line:
     name,primary_contact_name,primary_contact_email,mail_address,city,state,postal_code,country,phone
     • All fields except postal_code are mandatory. The separator should be a comma (,) and the file should be a valid CSV.
       
       Note: If you are using Excel, your CSV must be saved in the CSV UTF-8 format.
   • To add the contact details manually, click the Create New Vendor button from the Vendors page, then add information to the fields outlined below.
     
     1. Name: The name of the internal or third-party organization that you are working with and/or sending assessments to. 
     2. Contact Name: The name of the primary person/contact you will be working with for questionnaire assessments. 
     3. Contact Email: The email address of the person you've listed for the Contact Name, above.
        

        Important:

        The email address you enter for the Contact Email is where the automatic email notifications will be sent when you assign a questionnaire to your vendor. Before your vendor can complete a questionnaire, you will need to create a user account for your vendor contact. See the Adding User Accounts for Vendor Contacts section below for details.
     4. Telephone: The telephone number for either the organization or for the primary vendor contact at the organization. 
     5. Website: (Optional) The web address for the third-party organization. 
     6. Vendor Type: Select Internal or External. For example, an internal vendor may be a contracted business unit that provides services to your organization, while an external vendor is one outside of your organization.
     7. Street Address: Use this and the remaining fields to add the third-party organization's address. If the United States is selected for the Country field, the Region field name will change to State. 
3. After you've added the contact details, continue adding the Organization Overview details, as outlined below.
   
4. Organization Industry: Select the vendor's industry from the drop-down menu.
5. Data Types: Select all applicable categories of data that your vendor will store, process, or transmit in order to carry out operations for your organization. If the listed data types are not applicable, select Other.
   Click the drop-down below for details about the data types.
   Vendor Details: Data Types

   Acronym	Data Type	Description
   CPI	Client Privileged Information	Any information that is considered confidential communication between an attorney and their client.
   CUI	Controlled Unclassified Information	Federal, non-classified information that must be safeguarded by adhering to security requirements and controls designed to secure sensitive information.
   ECR	Export Controlled Research	Includes any information that is regulated for reasons of national security, foreign policy, anti-terrorism, or non-proliferation. This includes ITAR and EAR data types.
   FERPA	Family Educational Rights and Privacy Act	This act governs access to and the release of student education records.
   FISMA	Federal Information Security Management Act	This Aat requires federal agencies and any contracted parties to develop, document, and implement an information security and protection program for federal data.
   GLBA	Gramm Leach Bliley Act	This act requires financial institutions to explain how they share and protect their customers' sensitive data.
   PHI	Protected Health Information	Under HIPAA, protected health information is considered to be individually identifiable information relating to the past, present, or future health status of an individual that is created, collected, transmitted, or maintained by a HIPAA-covered entity in relation to the provision of healthcare, payment for healthcare services, or use in healthcare operations.
   IT	Information Technology (Security Information)	Information pertaining to safeguarding organizational IT resources.
   PCI	Payment Card Industry	Information pertaining to storing, processing, or transmitting credit card, debit card, or any other type of payment card data.
   PII	Personally Identifiable Information	Sensitive data that could potentially identify a specific individual.

6. Details of Services/Goods: You can optionally add details about the vendor in this field.
7. Once you've added all vendor details, answer the Qualifying Questions at the bottom of the page.
8. Click the Save Vendor button to add the vendor details to the vendor profile.

Back to top

Qualifying Questions

The qualifying questions found under each vendor's profile will help you assess the level of risk associated with using the third-party. 

Answer the qualifying questions as you're creating your new vendor in KCM GRC, or answer the questions at a later time by navigating to the Vendors page (Vendor Management > Vendors) and clicking the vendor name under the Name column.

Adding User Accounts for Vendor Contacts

Once you're ready to send a questionnaire to a vendor, you'll add a user account in KCM GRC for the appropriate person so they can complete the questionnaire. This user will log in to a separate vendor portal that is associated with your account. This vendor portal is specifically for the vendor contact to answer questionnaires and address issues that may arise from questionnaire responses. The Vendor User user role does not count against your licensed seat count for KCM, nor will this user have access to any of the information in your organization's account.

×

Activate Your Account Email

Close

Follow the steps below to add a vendor user account to your console:

1. Navigate to the vendor profile by clicking Vendor Management > Vendors from the navigation panel, then click the third-party organization's name from the Name column.
2. From the Vendor Details page, click the Contacts tab (shown below), then click the Create Vendor Contact button on the right-hand side.
   
3. Fill out the user information, then click the Create button.
   

   Note:

   The email address that you use to create the Vendor Contact should also be listed in the Contact Email field on the Organization Details area of the page. For more information, see the Organization Contact Details section of this article.

See our Working with Users article for more information about creating users. For more information on sending questionnaire assessments, see this article: Creating, Configuring, and Sending Questionnaires.

Back to top

Working With Vendor Profiles (Vendor Details)

This section provides an overview of the vendor risk management workflows you will carry out from the vendor profiles (Vendor Details pages). 

Vendor Details: Organization Details

1. Use the Update button to edit any of the information shown on the Vendor Details page.
2. Use the ARCHIVE button to archive the vendor profile. Archiving the vendor will automatically disable any Vendor Users listed under the Contacts tab in the vendor profile. This may be helpful if you will be working with the vendor at a later time. Note, if a vendor profile is archived you will not be able to create a new vendor profile with the same name.
3. Account Administrators can use the DELETE button to fully delete the vendor profile and all associated data. All iterations of questionnaires that were sent to, or completed by this vendor will be deleted. Deleting the vendor will automatically disable any Vendor Users listed under the Contacts tab in the vendor profile. This action cannot be undone.
4. The Vendor Score is calculated once the Vendor User (vendor contact) has completed and finalized one or more questionnaire assessments. Vendor scores range from 0 to 100%. This number is the average of the scores for all questionnaires completed by this vendor. Therefore, typically, the higher the vendor score, the lower the level of risk involved in working with this entity. If you'd like, you can manually offset the Vendor Score in the vendor profile, see more information below. 
5. The Vendor Score Offset represents the percentage by which you are offsetting the Original Vendor Score, which was calculated by the KCM platform. See the instructions below for more information.

Modifying Vendor Scores

Follow the steps below to offset the vendor score for a vendor profile.

1. Click the Update button at the top of the Vendor Details page.
2. Then, use the Vendor Score Offset field (shown above) to enter any integer between -100 and 100.
   For example, if the original vendor score is 89.4% and you enter "-3" in the Vendor Score Offset field, the adjusted vendor score will be 86.4%.
3. You can optionally leave a note explaining why you are offsetting the vendor score in the Vendor Score Adjustment Note field. 
4. Click the Save button to save the offset percentage.

The adjusted vendor score will be automatically shown in the vendor profile along with the original vendor score that was calculated by KCM.

Back to top

Click on the tabs below to learn about the workflows you'll carry out from the tabs found on Vendor Details pages (vendor profiles), under your VRM module. 

Back to top