Risk register
Threats, likelihood, impact, owner, and treatment for each risk, ready for annual review.
Risk assessment and vendor risk
A documented risk register and vendor review process that hold up in an audit and keep working after it.
- 1 to 2 weekstypical duration
- Fixed feequoted after a scoping call
- Add-onadded to an assessment
Overview
What this covers
SOC 2 expects you to identify your risks and manage the vendors that touch customer data. We run the risk assessment with your team, build the register, inventory your vendors, and give you a questionnaire process you can reuse for every new one.
Deliverables
What you receive
Vendor inventory
Every vendor that touches your data, rated by risk.
Vendor review kit
Questionnaires and a simple process for reviewing critical vendors before and after signing.
Related services
Pair it with
2 to 3 weeks
SOC 2 readiness assessment
A control-by-control review against the Trust Services Criteria, with a ranked plan to close every gap before your auditor arrives.
2 to 4 weeksPlatform setup and policy tailoring
Get real value from Vanta or Drata: integrations connected, controls mapped, and policies rewritten to match how you work.
Know where you stand in three weeks.
Start with a 20-minute call. You will leave with a clear sense of your scope, the report type your buyers need, and a fixed-fee proposal.