On this page0
Guide
Keep your risk register and vendor register
Write down the risks your company faces and the outside companies it relies on, give each an owner, score it, and record a security review of each vendor, so an auditor can see the list is kept.
Before you start
- A role that can manage compliance. In the built-in set, administrators have that permission. The “security_analyst” role has it too; no group carries it, so an administrator gives it to a person by hand, as Roles, groups and permissions shows. Someone who can only view reports can open both registers and read them, but sees no “Add risk” or “Add vendor” button.
- The Compliance Hub already set up. See Get started with the Compliance Hub.
- Email set up, if you want owners and reviewers to be told. See Set up email.
Open the Program tab
Step 1: Find the four cards
Go to Security & ComplianceCompliance Hub and click the “Program” tab. Four cards sit in a row: “Policies”, “Risks”, “Vendors” and “Statement of Applicability”. Each shows a count, one line about its state, and a button that opens it.
This guide covers “Risks” and “Vendors”. The other two cards are in Keep policies up to date and download the Statement of Applicability (SoA).
Keep the risk register
Step 2: Open the register
On the “Risks” card, click “Open risk register”. A window titled “Risk register” opens. While it is empty it reads “No risks yet. Add your top risks and link the controls that mitigate them.”
Step 3: Add a risk
Click “Add risk” and fill in the form:
- “Risk title”: required. One line saying what could go wrong.
- “Description” and “Category”: your own words. The category starts as “General”.
- “Likelihood” and “Impact”: each from 1 to 5, starting at 3. How likely it is, and how bad it would be.
- “Status”: “open”, “treating” (you are working on it), “accepted” (you have decided to live with it) or “closed”.
- “Owner”: type the person’s email address. The form says a name alone notifies nobody.
- “Treatment / mitigation plan”: what you are doing about it.
- “Mitigating controls”: pick the controls that reduce this risk. You can pick several.
Click “Add risk” at the foot of the form. The window returns to the list.
Step 4: Read the list
The columns are “Risk”, “Score”, “Status”, “Owner” and “Controls”. The score is likelihood multiplied by impact, so it runs from 1 to 25, and the two numbers are printed beside it (for example 12, then 3×4). The highest scores are listed first. A score of 15 or more is shown in red, 8 to 14 in amber, and anything lower in green.
“Controls” shows how many controls are linked. Hover over the number to read which ones; with none it reads “none linked”.
Step 5: Update or remove a risk
Click the pencil button at the end of a row, change what has moved (most often “Status”, the two numbers or the plan), and click “Save”.
The bin button asks “Delete this risk?” and names it. Click “Delete risk” to confirm. The risk goes with its score, plan and control links, and it cannot be brought back. For a risk that is finished with, setting “Status” to “closed” keeps the line on record instead.
Keep the vendor register
Step 6: Open the register and add a vendor
On the “Vendors” card, click “Open vendor register”. The window is titled “Vendor / third-party register”. Click “Add vendor” and fill in:
- “Vendor name”: required. “Category” starts as “SaaS”; type your own if it is something else.
- “Risk tier”: “low”, “medium”, “high” or “critical”. How much harm a failure at this company could do you.
- “Owner”: the person at your company who deals with this vendor.
- “SOC 2 / attestation on file”: switch on if you hold the vendor’s own audit report or certificate.
- “Shares customer/personal data”: switch on if the vendor receives personal data or your customers’ data.
- “Notes”: up to 500 characters.
Leave “Review status” and “Reviewed on” alone for now; steps 7 and 8 set them for you. Click “Add vendor” at the foot of the form.
Step 7: Ask someone to review the vendor
In the list, click the first button at the end of the vendor’s row (its tooltip reads “Security review”). Under “Review assignment”, type the reviewer’s email address in “Reviewer (email)”, pick a date in “Review due by”, and click “Request review”.
A green message confirms “Review requested” and says the reviewer is emailed, when outgoing email is set up. If you typed a name rather than an address, an amber message says the review was requested “but nobody was notified”: type the address and click “Request review” again.
Step 8: Record the result
When the review is done, open the same panel. Under “Complete review”:
- “Risk decision”: “Approved”, “Approved with conditions” or “Rejected”. Required.
- “Residual risk”: the risk left after what the review found, from “low” to “critical”. It is saved with the review record and does not change the vendor’s “Risk tier”; the “Review history” list on this screen does not show it.
- “Next review due”: when to look at this vendor again. A date one year ahead is filled in for you; it must be in the future.
- “Documents collected”: tick what you received: “SOC 2 report”, “ISO 27001 cert”, “Penetration test”, “DPA signed” (a data processing agreement) or “Security questionnaire”.
- “Findings / summary”: what the reviewer concluded, in up to 1,000 characters.
Click “Complete review”. The message reads “Review completed. Next review due” with the date. Both the request and the result are added under “Review history”, newest first. Click “Back” to return to the list.
Step 9: Read the list, and edit or remove a vendor
The columns are “Vendor”, “Tier”, “Review” and “Decision”. “Review” shows “none”, “requested”, “received” or “reviewed”, and under it a date: “due” while a review is open, “next” once it is done, and “overdue” in red when the date has passed.
The pencil button edits the vendor. The bin button asks “Delete this vendor?”; confirming with “Delete vendor” removes it together with its review history, and it cannot be brought back.
What you should see
Back on the “Program” tab, the “Risks” card shows how many risks you hold and a line such as “4 open or in treatment · 1 high”. “High” counts risks that are open or in treatment with a score of 15 or more, and turns the line red.
The “Vendors” card reads “All reviewed” in green when every vendor has a decision and no review date has passed. Otherwise it says how many are “without a risk decision” and how many are “overdue for review”.
If something goes wrong
- There is no "Add risk" or "Add vendor" button, and no pencil or bin on the rows
- Your role can read the registers but not change them. Ask an administrator for a role that can manage compliance.
- "A title is required." or "A vendor name is required."
- Fill in "Risk title" or "Vendor name" and save again. Nothing else on either form is required.
- "The reviewer is not a complete email address."
- Correct the address in "Reviewer (email)". To record the request without telling anyone, type a name with no @ sign instead.
- "Pick a risk decision to complete the review."
- Choose Approved, Approved with conditions or Rejected under "Risk decision", then click "Complete review" again.
- "Set the next review date to a date in the future."
- Pick a later date in "Next review due". A date one year ahead is the suggestion.
- A card on the Program tab says "Couldn’t load this."
- Click "Retry" on the card. The card shows that message instead of a count when the list could not be read, so an empty-looking card is never a failed one.
- The Compliance Hub is not in your menu
- The hub is part of the Advanced plan, and it is shown only to people who can manage compliance or view reports. Check your plan under System, then License & Entitlements, and your role with an administrator.
Still stuck? See When something goes wrong, or Contact Zonitix support.