# Onboard a new vendor

A journey from identifying a third party to its first assessment.

> **Access:** member. Subject to enabled modules and your plan.

## How do you onboard and assess a vendor?

In CISAPP, vendor onboarding means finding or creating the record, qualifying criticality, linking business activities and preparing a suitable assessment. Reviewing answers and evidence then supports follow-up decisions. This third-party risk management journey keeps vendor identification connected to assessment.

## Goal and preparation

Obtain a reliable record, qualify business importance and prepare the first assessment. Prepare the website, vendor contact and supported activities. You need vendor-creation and assessment-creation permissions and an available quota.

## 1. Identify the third party

Search for the company under **Registers → Suppliers** first. If it exists, open its record and check access. Otherwise, follow [Create a vendor](https://docs.cisapp.eu/en/registers/create-vendor).

## 2. Qualify the relationship

Enter contact details, choose business criticality and add useful contacts. Identify who will answer the questionnaire and who will own the relationship in your organization.

![Qualifying the vendor](https://docs.cisapp.eu/images/en/vendor-criticality.webp)

*Criticality helps match review effort to business importance. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/vendor-criticality.webp)*

## 3. Link activities

Open relevant [business activities](https://docs.cisapp.eu/en/registers/activities) and link the vendor. Then check the [dependency map](https://docs.cisapp.eu/en/reporting/dependencies).

## 4. Start the first assessment

Choose a questionnaire suited to the need. Follow [Assess a vendor](https://docs.cisapp.eu/en/assessments/vendor), review the scope and check respondent access.

## 5. Plan follow-up

Record points to clarify and organize actions after responses arrive. Create a risk when the scenario warrants it and an action plan if several actions are needed.

## Success criteria

The record is identifiable, criticality is recorded, useful dependencies are linked and the assessment is accessible to the relevant people. No duplicate was created to work around an access problem.

## Common questions

### Do you need a new vendor record for every assessment?

No. Search for the vendor first and use its existing record if it represents the company being assessed. A new assessment does not justify a duplicate; check permissions if the record is inaccessible.

### What information should you prepare before onboarding?

Prepare the vendor’s identity and website, the service, supported activities and useful contacts. Business criticality and questionnaire expectations should match this relationship, not just the company name.

### Does an assessment automatically determine the risk decision?

The decision requires a review of answers, evidence and business context. Read the [assessment results](https://docs.cisapp.eu/en/assessments/results), then document risks and actions needing follow-up.

Explore more [questions about vendors, risk and compliance](https://docs.cisapp.eu/en/help/common-questions).