New Vendor Review
End-to-end workflow for evaluating a new vendor, from submission to final decision.
Steps
- Vendor Submission — Buyer or procurement team submits a new vendor for evaluation via the Vendor Intake form.
- Auto-Enrichment — Platform automatically enriches the vendor profile using public data sources (SEC filings, breach databases, domain intelligence).
- Questionnaire Distribution — A tailored security questionnaire is sent to the vendor contact based on their industry and risk tier.
- Evidence Upload — Vendor uploads compliance certifications, SOC reports, penetration test results, and policies to the Evidence Vault.
- AI Pre-Analysis — AI engine parses evidence documents and questionnaire responses, flags gaps, and generates a preliminary risk assessment.
- Analyst Review — A human security analyst reviews AI findings, verifies evidence authenticity, and assesses residual risk.
- Trust Score Calculation — The 8-dimension trust score is computed based on all collected data and analyst input.
- Committee Decision — For high-risk or large vendors, a review committee convenes to make the final approve/reject decision.
- Decision Communication — The vendor and internal stakeholders are notified of the outcome with a detailed report and recommended conditions.
- Onboarding / Remediation — Approved vendors enter onboarding; conditional approvals trigger remediation workflows with deadlines and follow-ups.
Evidence Collection & Upload
How vendors submit compliance evidence and how it flows through verification.
Steps
- Request Created — An evidence request is generated (manually or automatically from a questionnaire gap).
- Vendor Notified — Vendor receives an email with a secure upload link and a list of required documents.
- Document Upload — Vendor uploads files (PDF, DOCX, images, or ZIP) to the Evidence Vault via the secure portal.
- AI Parsing — Uploaded documents are parsed by AI to extract key metadata, expiry dates, control mappings, and certifications.
- Integrity Check — File hashes are computed and stored. Any tampering after upload is detectable.
- Analyst Verification — Human analyst reviews parsed data, confirms accuracy, and marks evidence as verified or requests re-upload.
- Vault Sealed — Verified evidence is sealed into the vault with an immutable audit trail and linked to the vendor profile.
Risk Assessment
How risk tiers are assigned and how they affect vendor evaluation priority.
Steps
- Data Access Classification — Determine what data the vendor will access (PII, PHI, financial, public).
- Integration Scope — Assess the depth of system integration (API, network, physical, none).
- Inherent Risk Scoring — AI calculates an inherent risk score based on data sensitivity, industry, and geography.
- Tier Assignment — Vendor is assigned a risk tier (Critical, High, Medium, Low) that determines SLA and review depth.
- Control Mapping — Required controls are mapped based on the risk tier and applicable frameworks (SOC 2, ISO 27001, GDPR).
Trust Score Calculation
How the 8-dimension composite trust score is computed for each vendor.
Steps
- Data Aggregation — All evidence, questionnaire responses, monitoring data, and public intelligence are aggregated into the scoring engine.
- Dimension Scoring — Each of the 8 dimensions (Security Maturity, Deployment Readiness, AI Governance, Transparency, Resilience, Remediation Speed, Data Trust, Executive Confidence) is scored individually (0-100).
- Weighting — Dimension weights are applied based on the buyer's industry, risk appetite, and compliance requirements.
- Composite Calculation — A weighted composite score is computed, along with confidence intervals and trend indicators.
- Profile Publication — The trust profile is published to the vendor's profile page with a visual breakdown and historical trend chart.
Continuous Monitoring
How ongoing vendor risk is tracked after initial approval.
Steps
- Monitoring Enrollment — Approved vendors are automatically enrolled in continuous monitoring based on their risk tier.
- Signal Collection — Threat intelligence feeds, breach databases, certificate transparency logs, and domain reputation are scanned daily.
- Alert Generation — Anomalies and material changes trigger alerts that are routed to the assigned analyst.
- Trust Score Update — Significant events cause automatic trust score recalculation with before/after comparison.
- Stakeholder Notification — Buyers who rely on the affected vendor receive real-time notifications and recommended actions.
Score Appeals
How vendors can dispute or request reconsideration of their trust score.
Steps
- Appeal Submission — Vendor submits an appeal through the Trust Profile page with supporting evidence or corrections.
- Review Queue — The appeal enters the analyst review queue, prioritized by vendor risk tier.
- Evidence Re-Evaluation — Analyst reviews new evidence, compares against previous findings, and may request clarification.
- Score Adjustment — If the appeal is valid, the trust score is recalculated and the profile is updated with an audit note.
- Outcome Notification — Vendor receives the decision with a detailed explanation, regardless of outcome.
Framework Mapping
How CybersecCloud maps vendor controls to compliance frameworks.
Steps
- Framework Selection — Choose applicable frameworks (SOC 2, ISO 27001, NIST CSF, GDPR, HIPAA, etc.) from the compliance library.
- Control Extraction — Platform extracts individual control requirements from each framework.
- Cross-Mapping — Controls are automatically cross-mapped between frameworks to identify overlaps and reduce duplicate assessments.
- Gap Analysis — Vendor's existing evidence and responses are evaluated against each control to identify gaps.
- Remediation Plan — Unmet controls generate remediation tasks with deadlines and priority levels.
Audit Trail
Immutable activity logging for compliance and accountability.
Steps
- Event Capture — Every action (login, view, edit, upload, decision) is captured with timestamp, actor, and IP address.
- Immutable Storage — Events are written to an append-only log that cannot be modified or deleted.
- Search & Filter — Use the Audit Log page to search events by vendor, user, action type, or date range.
- Export — Export filtered logs as CSV or PDF for external auditors and compliance teams.
Remediation Tracking
How remediation tasks are assigned, tracked, and verified.
Steps
- Task Creation — Remediation tasks are auto-generated from compliance gaps, analyst findings, or committee conditions.
- Assignment — Each task is assigned to the vendor with a deadline, priority, and detailed description.
- Vendor Action — Vendor implements the fix and uploads proof of remediation (new policy, reconfigured system, etc.).
- Verification — Analyst reviews the remediation evidence and marks the task as resolved or requires further action.
- Score Impact — Successful remediation triggers a trust score recalculation, improving the vendor's profile.
- Deadline Enforcement — Overdue tasks escalate automatically, with notifications to both the vendor and internal stakeholders.
Support Ticket Submission
How to submit a support ticket and track its resolution.
Steps
- Ticket Creation — Submit a ticket via the Help Center, in-app support widget, or email to support@cyberseccloud.com.
- Auto-Classification — AI classifies the ticket by category (billing, technical, security, feature request) and priority.
- Agent Assignment — Ticket is routed to a specialist based on category, priority, and current agent workload.
- Investigation — Agent investigates the issue, may request additional details, and provides status updates.
- Resolution — Agent resolves the issue and provides a detailed explanation. Affected systems are verified.
- Feedback — You receive a satisfaction survey. Your feedback helps improve our support quality.
Escalation Path
How critical or unresolved tickets escalate through support tiers.
Escalation Tiers
- Tier 1 — Front-line Support — Initial response, triage, and resolution of common issues. Target: 4-hour response.
- Tier 2 — Technical Specialist — Complex technical issues escalated from Tier 1. Deep investigation with platform engineers.
- Tier 3 — Engineering — Platform bugs, infrastructure issues, or security incidents requiring code-level investigation.
- Executive Escalation — For critical business-impacting issues, a named executive sponsor is assigned until resolution.
Need more help? Check out the FAQ or contact support.