---
title: "Vendor assessment"
canonical: "https://auditbadger.com/features/vendor-assessment/"
last-updated: "2026-10-18"
---

# Vendor assessment

Third-party risk management: vendor register, risk tiers, security questionnaires, a vendor portal reached through a secure link (no vendor account needed), and a full assessment audit trail. Supports ISO 27001 controls A.5.19 to A.5.23.

## What it does

| Capability | Detail |
|---|---|
| **Vendor register** | Centralized list of all third parties with risk tier and status |
| **Risk tiers** | You set each vendor's tier: **Low / Medium / High / Critical** |
| **Customizable questionnaires** | Question templates you can tag by risk tier |
| **Vendor portal** | Vendors open a secure tokenized link, with no account or login, to answer the questionnaire and upload documents where a question asks for them |
| **Risk register links** | Link vendors to the risks they concern in your risk register |
| **Evidence requests** | Record the documents you need from a vendor (SOC 2 reports, ISO certificates, pen-test results) on the assessment |
| **Review cadence** | One review cadence for the account (12 months by default); your team gets a notice 30 days before a vendor review is due |
| **Audit trail** | Changes to vendors, assessments, responses and reviews are recorded with a timestamp |

## Vendor portal experience

- Email invitation with a secure questionnaire link, sent per vendor contact
- No vendor account or login: access is through a unique, unguessable link
- Auto-save lets vendors complete assessments across sessions
- File uploads on questions that ask for documents
- Help text per question, a progress bar, and a required-answers check on submit

## Standards alignment

| Framework | Reference |
|---|---|
| **ISO 27001:2022** | A.5.19 (Information security in supplier relationships), A.5.20 (Addressing security in agreements), A.5.21 (Managing security in ICT supply chain), A.5.22 (Monitoring and review), A.5.23 (Information security for cloud services) |
| **SOC 2** | CC9 (Risk mitigation), CSOCs (subservice org carve-out documentation) |

## Useful links

- Sign up: [auth.auditbadger.com/signup](https://auth.auditbadger.com/signup)
- All features: [/features](/features)
- Risk assessment (companion module): [/features/risk-assessment](/features/risk-assessment)
- Assessment management (questionnaire engine): [/features/assessment-management](/features/assessment-management)
- ISO 27001 deep dive: [/compliance/iso27001](/compliance/iso27001)