# Common questions about vendors, risk and compliance

CISAPP helps organize vendors, their assessments, risks and compliance information. Find short answers to common third-party risk management questions, then follow the procedures to put them into practice. Available modules depend on your plan and permissions.

## How do you assess a vendor’s security?

Define the service and affected business activities, qualify the vendor’s importance, then choose a questionnaire suited to the information you need. Review responses and evidence before deciding follow-up actions. In CISAPP, the journey links a vendor record to an assessment; a score alone does not replace this review.

Follow [Onboard a vendor](https://docs.cisapp.eu/en/guides/onboard-vendor), then [Launch an assessment](https://docs.cisapp.eu/en/guides/launch-assessment).

## What is the difference between vendor criticality and cyber risk?

Criticality describes how important the vendor is to your business and the consequences of its failure. Risk concerns a scenario, its likelihood and its impact. A critical vendor deserves attention, but its criticality alone does not demonstrate a security weakness.

See [Create and qualify a vendor](https://docs.cisapp.eu/en/registers/create-vendor) and the [risk register](https://docs.cisapp.eu/en/risks/register).

## Which vendors should you assess first?

Start with vendors supporting important activities, creating strong dependencies or requiring an upcoming decision. Check existing assessments and missing information to avoid duplicate requests. Priority depends on your business context and risk method.

Use the [dependency maps](https://docs.cisapp.eu/en/reporting/dependencies) and [Prepare a third-party risk committee](https://docs.cisapp.eu/en/guides/risk-committee).

## How do you choose a vendor assessment questionnaire?

Choose a questionnaire whose purpose and questions match the subject being assessed. Review sections, expected answers and useful evidence before selecting it. In CISAPP, a questionnaire may be absent from the picker because of its purpose or your permissions.

See the [questionnaire library](https://docs.cisapp.eu/en/assessments/questionnaires) and [assessment types](https://docs.cisapp.eu/en/assessments/types).

## How do you answer a security questionnaire you have received?

Open the invitation with the account matching its recipient address, check the subject and complete answers with their evidence. Check that changes are saved, then check the status after submission when that action is offered. A saved response is not necessarily a finalized response.

Follow [Respond to a received questionnaire](https://docs.cisapp.eu/en/guides/respond-questionnaire).

## What should you check when a respondent cannot open an assessment?

Check the account address, activation, invitation validity and resource access. Organization roles and assessment permissions are separate checks. Recreating an assessment does not necessarily resolve a sharing problem.

See [Permissions and sharing](https://docs.cisapp.eu/en/organization/permissions) and [troubleshooting](https://docs.cisapp.eu/en/help/troubleshooting).

## How do you turn a risk into an action plan?

Describe the scenario, assess it with your method and choose a treatment. Assign controls to owners and deadlines, verify their completion and reassess residual risk. An action plan can organize actions, but creating it does not prove the risk has been treated.

Follow [Move from a risk to a treatment plan](https://docs.cisapp.eu/en/guides/treat-risk).

## What is the difference between initial and residual risk?

Initial risk is the level assessed before the planned treatment. Residual risk is what remains after taking controls into account. Its reassessment should rely on controls actually completed and the evidence available.

See the [treatment plan](https://docs.cisapp.eu/en/risks/treatment) and [glossary](https://docs.cisapp.eu/en/help/glossary).

## Which indicators should you prepare for a vendor risk committee?

Gather critical vendors, assessment progress, missing answers or evidence, risks requiring decisions and actions to follow up. Add important dependencies and, with an authorized account, exemptions nearing their deadline. Date the information and specify its scope.

Follow [Prepare a third-party risk committee](https://docs.cisapp.eu/en/guides/risk-committee) and the [dashboard guide](https://docs.cisapp.eu/en/reporting/dashboard).

## How do you organize compliance evidence?

Link applicable requirements to controls and the evidence demonstrating their completion. Check document access so reviewers can read them. Storing evidence alone does not establish compliance.

See [Requirements, controls and evidence](https://docs.cisapp.eu/en/compliance/requirements-controls) and [file management](https://docs.cisapp.eu/en/collaboration/files).

## What is a Trust Center used for?

A Trust Center presents trust information and supports sharing under configured access rules. It complements assessments and document exchanges; it does not replace reviewing the information received. Availability in CISAPP depends on module activation and your plan.

See [Configure and use the Trust Center](https://docs.cisapp.eu/en/compliance/trust-center).

## What is the difference between vendor assessment and ASM?

An assessment collects and reviews information about a subject using questionnaires and evidence. ASM concerns the external attack surface: scopes, exposed assets and vulnerabilities. They provide complementary information without covering all risks on their own.

See [Assess a vendor](https://docs.cisapp.eu/en/assessments/vendor) and [ASM and attack surface](https://docs.cisapp.eu/en/security/scopes-analyses).

## Can you import a questionnaire from Excel?

Yes, when Excel questionnaire import is enabled for your plan. CISAPP analyzes the workbook; you then review sheets, sections and recognized elements, correct mappings if necessary and publish the questionnaire. Pay particular attention to merged cells and ambiguous headers.

Follow the [Excel import guide](https://docs.cisapp.eu/en/assessments/excel-import).

## Can you already use the NIS2 and DORA screens in CISAPP?

Dedicated NIS2 and DORA screens are under construction in the verified version. Appearing in a menu does not mean the workflow is operational. Check available compliance features and documented limitations before organizing your work.

See [NIS2, DORA and AI Act](https://docs.cisapp.eu/en/compliance/overview) and [feature availability](https://docs.cisapp.eu/en/help/availability).

## How can you use this documentation with an AI assistant?

Give the assistant the relevant Markdown article or the index for your language, then ask it to cite sources and explain access conditions. If it cannot fetch URLs, attach the downloaded file. Public documentation does not grant access to your account data.

See [Use the documentation with AI](https://docs.cisapp.eu/en/help/use-with-ai).