# Vendors

> Build your third-party register, tier vendors by risk, send assessments and track reports and expiry dates.

Source: https://docs.csquaregrc.com/guides/vendors


The **Vendors** module is your third-party register.

## Set up your vendor register

1. **Collect the list.** Start from finance (who you pay) and IT (what you have SSO or API connections to).
2. **Import or add vendors.** For each, record what they do for you, what data they touch, which systems they connect to and who owns the relationship.
3. **Tier each vendor** by data and access.
4. **Send assessments** to the highest tiers first.

```text
Here is our vendor list: <paste names>. Suggest a risk tier for each based on typical data access, and tell me which assessments to send first.
```

## Risk tiering

| Tier | Typical profile | Review cadence |
| --- | --- | --- |
| Critical | Processes sensitive data or is core to service delivery. | Yearly, with report review. |
| High | Access to internal systems or personal data. | Yearly. |
| Medium | Limited data, replaceable. | Every two years. |
| Low | No data access. | At onboarding. |

These are common defaults; adjust them to your policy.

## Assessments

Send security questionnaires, store reports such as SOC 2 or ISO certificates, and track expiry dates. Findings become tasks or [remediation](/guides/remediation) items.

```text
Draft a security questionnaire for <vendor>, scaled to their access: they process <data types> and connect to <systems>. Keep it under 30 questions.
```

```text
Summarize the SOC 2 report I uploaded for <vendor>: audit period, scope, exceptions, and the complementary user entity controls we need to implement.
```

## Contracts

Record DPAs, BAAs and security addenda on the vendor. For HIPAA, every business associate needs a signed BAA.