Vendor risk management software: third party risk management software and a TPRM platform for teams of 5 to 200

Vendor risk management software is one system that holds every third party your company relies on, scores each by the risk it introduces, stores the due diligence you collected, and enforces a review cadence with named owners. It replaces the spreadsheet and the shared drive folder with a record that shows an auditor you are actively managing suppliers rather than listing them once at onboarding.

It is the same category. Third party risk management software, vendor risk management software and TPRM platform all describe a tool that inventories your suppliers, assesses the risk each one carries, tracks the evidence behind that assessment, and re-checks it on a schedule. Enterprise buyers tend to say third party risk, smaller teams tend to say vendor risk, and the product does the same job.

Most of the category is quote-only. UpGuard publishes Standard at $1,750 a month billed annually for 50 monitored vendors, with extra vendors at $79 a month, and its higher tiers are quote-only. Bitsight, SecurityScorecard, ProcessUnity, Prevalent, Venminder, OneTrust, Vanta and Drata publish no figures at all. Complies publishes $79, $199 and $499 a month, with vendor risk included from the $199 Growth plan.

Yes, in substance. SOC 2 criterion CC9.2 covers assessing and managing risks from vendors and business partners, and auditors test it by asking for your vendor inventory, how you tiered it, and evidence that reviews happened. A critical vendor with no security review on file is one of the more common findings in a first Type 2.

Yes. ISO/IEC 27001:2022 Annex A devotes four controls to it: A.5.19 information security in supplier relationships, A.5.20 addressing security within supplier agreements, A.5.21 managing security in the ICT supply chain, and A.5.22 monitoring, review and change management of supplier services. A.5.22 is the one that catches people, because it asks for evidence you re-check suppliers on a schedule.

Vendor management is commercial: contracts, renewals, spend, performance and the relationship. Third party risk management is about the risk that supplier introduces to your data, your operations and your compliance obligations. They overlap in the register and diverge in what you do next. A procurement tool tracks the contract value; a TPRM tool tracks whether the vendor can be trusted with production access.

A vendor risk assessment is the structured review you run on a single supplier before you onboard it and then periodically afterwards: what data it will touch, what access it needs, what its security posture looks like, and what contractual protections you have. The output is a tier, a decision, an owner and a review date. Our full walkthrough covers the tiering model, the questionnaire and what to collect at each tier.

No, and trying is how programs collapse. A risk-based approach is what the frameworks expect: assess depth in proportion to the data and access involved. A vendor holding customer records or production credentials earns a full questionnaire and an annual review. A stock photo subscription earns a line in the register and a note explaining why it stops there. Write the reasoning down, because the reasoning is what gets tested.

For a critical vendor: a current SOC 2 Type 2 report or ISO 27001 certificate, a completed security questionnaire, a certificate of insurance, a signed data processing agreement, and a business associate agreement if PHI is involved. Read the SOC 2 rather than filing it, because the exceptions in Section 4 and the complementary user entity controls are the parts that actually change what you have to do.

For ten or fifteen vendors, honestly yes, and we will say so. It stops working at the point where certificates start expiring, owners change, and nobody notices for eight months, which in practice is somewhere between thirty and fifty vendors. The tell is simple: if you cannot answer "when was this vendor last reviewed and by whom" in under a minute, the spreadsheet has already failed.

A security ratings platform such as UpGuard, Bitsight or SecurityScorecard scans a vendor from the outside and produces a continuously updated score. That is a genuinely useful signal and Complies does not produce it. What Complies produces is the program record: the tier, the documents, the decision, the owner, the review dates and the mapping to SOC 2, ISO 27001 and PCI DSS control requirements. Larger programs run both.

More than the finance report shows. Once you count SaaS bought on a card, tools connected through OAuth, and subprocessors of your main platforms, a 50 person software company commonly lands somewhere between 60 and 150 third parties. The first honest inventory is usually the most useful thing a vendor risk program produces, because it surfaces the ones nobody was tracking at all.