Workflow Template

Third-Party Security Assessment Workflow

Assesses a vendor's security posture end-to-end: intake of vendor and assessment owner details, sending a security questionnaire to the vendor contact, internal review of the findings by a security reviewer, risk manager approval of residual risk, and notification of the outcome to the vendor and assessment owner.

Security teams tracking vendor assessments across inboxes and spreadsheets lose visibility into who has responded, who still needs to review findings, and which vendors are stuck waiting on remediation. This workflow moves a vendor security assessment through a single record: intake, questionnaire delivery, security reviewer findings, risk manager approval, and outcome notifications all happen in sequence, with status updates and a timeline showing exactly where each vendor stands. Assessment owners and vendors get notified automatically, so the team spends less time chasing updates and more time evaluating risk.

Business Outcomes

Reduces time spent manually tracking vendor questionnaire responses
Improves visibility into where each vendor assessment stands via status and timeline
Supports faster handoff between security reviewer and risk manager decisions
Helps standardize the risk findings and remediation data captured per vendor
Reduces manual follow-up emails to vendors and assessment owners

Workflow Steps

Steps

1
Create Vendor Assessment Recordcreate record
Creates the vendor assessment record from the submitted intake form.
2
Set Status: Questionnaire Sentupdate record
Sets the assessment status to Questionnaire Sent.
3
Email Assessment Owner Acknowledgementsend email
Sends the assessment owner an acknowledgement email including the assessment reference number.
4
Send Security Questionnaire to Vendor Contactrequest external input
Emails the vendor contact a security questionnaire and waits for their response.
5
Persist Questionnaire Responsesupdate record
Saves the vendor's questionnaire responses onto the assessment record.
6
Set Status: Under Reviewupdate record
Sets the assessment status to Under Review once the vendor has responded.
7
Security Reviewer: Assess Vendor Responsescreate task
Assigns the security reviewer a task to record risk findings, remediation required, residual risk and reassessment date, due in 10 days.
8
Persist Review Findingsupdate record
Saves the reviewer's risk findings, remediation required, residual risk and reassessment date to the record.
9
Risk Manager: Approve Residual Riskrequest approvalrequires approval
Requests the risk manager's approval or rejection of the assessed residual risk.
10
Route on Risk Manager Decision
Routes the workflow based on whether the risk manager approves or rejects the residual risk.
approval_status: "approved"→Set Status: Accepted
approval_status: "rejected"→Set Status: Remediation Required
Default→End
11
Set Status: Acceptedupdate record
Sets the assessment status to Accepted following risk manager approval.
12
Email Assessment Owner: Acceptedsend email
Emails the assessment owner the residual risk rating and reassessment date.
13
Set Status: Remediation Requiredupdate record
Sets the assessment status to Remediation Required following risk manager rejection.
14
Email Vendor Contact: Remediation Requiredsend email
Emails the vendor contact the remediation required to address the assessed risk.

Fields

Show all 17 fields

FormThird-Party Security Assessment Intake

Assessment Owner Name*· Text
Assessment Owner Email*· Email
Third Party Name*· Text
Vendor Contact Name*· Text
Vendor Contact Email*· Email
Service Provided*· Text
Data or Systems Accessed*· Long text

TaskSecurity Reviewer: Assess Vendor Responses

Risk Findings*· Long text
Remediation Required*· Long text
Residual Risk*· Choice
Reassessment Date*· Date

Other fields

Assessment Status· Choice
Holds Security Certification (e.g. ISO 27001, SOC 2)*· Choice
Multi-Factor Authentication Enforced*· Choice
Data Encrypted at Rest and in Transit*· Choice
How Customers Are Notified of Incidents*· Long text
Subprocessors*· Long text

Assessment Owner Name*
Assessment Owner Email*
Third Party Name*
Vendor Contact Name*
Vendor Contact Email*
Service Provided*

Forms

Third-Party Security Assessment Intake

7 fields

Data Views

Vendor Security Assessments

third_party_name, service_provided, residual_risk, reassessment_date +1 more

Dashboard Widgets

Assessments by Status

Recommended integrations

Setup the following integrations to extend workflow capability.

Send email in the workflow
AWS SES

third party security assessmentvendor security reviewsecurity questionnairesupplier cyber riskthird party risk

Similar Workflows

Supplier Risk Assessment Workflow Supplier Onboarding Workflow Privacy Impact Assessment Workflow

Similar Categories

Cybersecurity & Privacy Risk Management Finance & Procurement

FAQs

What happens if the vendor never responds to the security questionnaire?

The assessment record stays at Questionnaire Sent status until the vendor submits their responses, since the workflow waits at that step. The record's timeline and table view make it easy to spot assessments stuck at this stage so the assessment owner can follow up with the vendor contact directly.

Can this handle a risk manager decision that isn't a simple approve or reject?

The routing step includes an 'otherwise' path alongside approved and rejected, so the workflow can be extended to handle other outcomes. By default the two named outcomes set the record to Accepted or Remediation Required, and the routing logic can be edited in the workflow editor to add further branches.

What if we need the security reviewer to have more or less than 10 days?

The 10-day due date on the reviewer task is a configurable part of the workflow. It can be changed by describing the new timeframe in plain English or by editing the task step directly in the workflow editor, with earlier versions kept.

Who is actually involved in completing an assessment?

The vendor contact completes the emailed security questionnaire, a security reviewer is assigned a task to record risk findings and residual risk, and a risk manager approves or rejects that residual risk. The assessment owner is kept informed by email at acknowledgement and at the accepted outcome, without needing an account.

What data does the security reviewer actually record on the assessment?

The reviewer task captures Risk Findings, Remediation Required, Residual Risk and a Reassessment Date, and because the workflow waits for this task, all four values are saved onto the assessment record. These fields then feed the risk manager's approval decision and appear in the record timeline.

Can we customise the questionnaire questions sent to vendors?

Yes, the security questionnaire's questions can be changed by describing the change in plain English or by editing that step in the workflow editor. Whatever questions are configured, the vendor's answers are still saved onto the assessment record once submitted.

What does the vendor see when remediation is required?

If the risk manager rejects the residual risk, the status updates to Remediation Required and the vendor contact receives an email describing the remediation needed to address the assessed risk. The assessment record's status and timeline reflect this outcome for internal tracking.

Do vendors or assessment owners need to log into anything?

No, vendors and assessment owners take part entirely through the public request form and forms emailed to them at each step. They never need to create or log into an account to submit intake details or questionnaire responses.

Can we add more approval steps, like a second reviewer?

Yes, additional tasks or approvals can be added by editing the workflow in the workflow editor or by describing the change in plain English. Tasks and approvals are assigned to workspace members, so a second reviewer step could be inserted before the risk manager's decision if needed.

Ready to use this workflow?

Create a free account and customise this workflow for your business.