Vendors, assets & AI
Add a vendor and assign responsibility
Create a vendor profile and select business and security owners where you have update permission.
Before you start
Who this is for: Users with vendor-creation permission; owner assignment requires vendor-update permission.
- Search the vendor register for an existing record.
- Identify the service, vendor website, and responsible members in this organization.
Follow these steps
Create the profile
Open Risk > Vendors and choose Add vendor. Enter the Name and available identifying information, including External ID, Website, and Trust center / security URL when known. Describe Services provided and the vendor's relationship to your organization.
Review lifecycle and disclosure
Choose the appropriate Lifecycle state. Read any Trust Center disclosure option before changing it, because vendor information may participate in an external disclosure workflow. Record the organization's verified relationship and review decision rather than assuming every supplier is a subprocessor.
Assign responsibility
After creating the vendor, open its detail. Authorized users can choose a Business owner and Security owner in the owner panels. Select active members with the intended responsibilities. Business ownership and security ownership are separate fields and can require different follow-up work.
Verify and plan review
Reload the detail and verify the profile and owner displays. Inspect the vendor's review area and required evidence to decide what information needs to be collected next. A completed profile or populated security URL does not establish that a security assessment has been completed.
What you should see
The vendor is registered with useful service context and explicit business and security responsibility.
If something doesn’t look right
Owner selectors are not editable
Ask an administrator to check vendor-update permission. Read access displays the current owner without granting assignment rights.
The intended owner is absent
Verify active organization membership and ask an administrator about eligibility.
A duplicate vendor appears
Compare identifiers and service context before importing or creating another record. Use the reviewed import duplicate-handling workflow when processing a register.
Still need a little help?
Ask the assistant about these steps, or tell our team where you got stuck.
Contact support