Products
Onspring delivers immediate ROI
1
week to design and launch a custom application
100%
vendor response rate within two weeks
100%
remediation validation
Proactive and Scalable Third-party Risk Software
See how Onspring’s Third-party Risk Management software can help you.
Dive into the details of Onspring’s Third-party Risk Management software, including dashboard filtering, automated workflows and multi-app reporting.
Onspring Third-party Risk Management Software
Your organization can manage third-party risk throughout the relationship, not just during certification, by implementing monitoring requirements to respond to risk events and maintain compliance with policies and regulations.
Identification
- Maintain third-party inventory
- Conduct business engagement survey
- Tier engagements by risk
- Scope risk profiles
Assessment
- Conduct discovery survey
- Collect industry standards and fourth-party documentation
- Conduct engagement risk questionnaire and optional privacy questionnaire
Analysis
- Review responses
- Request additional information
- Document deficiencies
- Update risk domain scores
- Report results
Remediation
- Review observations
- Potentially escalate to findings or exceptions
- Begin contract process
Monitoring
- Conduct selection surveys
- Conduct active engagement performance surveys
- Set risk tier schedule
- Monitor security ratings services
- Request information as needed
Evidence alignment
- Collect and review vendor documentation—such as SOC 2, ISO-27001, etc. or CAIQ, SIG, and/or VSA Questionnaire—for risk domains prior to the execution of Engagement Risk Questionnaire
- Document Nth parties being leveraged to deliver the service or product in scope of related third-party engagements
Onspring AI for Third-Party Risk Management
Onspring AI liberates third-party risk management professionals to concentrate on higher-value responsibilities that demand uniquely human skills.
- Onspring AI can review a third-party SOC2 report and populate fields in third-party risk management for you.
- Onspring AI can protect reporting integrity by identifying pesky duplicate vendor entries, ensuring your team isn’t duplicating vendor data across different departments skewing reports.
- Let Onspring AI simplify the third-party review process by extracting responses to security review assessments.
Success Story
Using Onspring, Log4j’s VRM team built a survey to collect vendor responses in one week. After just six weeks, the team had closed out 82 records with remediation verified. Of the 82 high-risk vendors that were assessed, 31 total vendors were vulnerable to Log4j. The team’s prompt remediation efforts helped ensure that company data was not compromised due to a vendor breach.
Related Resources
-
RapidRatings Integration Data Sheet
See how financial risk intelligence from RapidRatings works in Onspring to provide a clear view of your third-party risk.
-
6 Benefits of Using Vendor Risk Assessment Software
From minimizing disruptions to empowering teams with actionable insights, learn how tools like Onspring and Black Kite enhance efficiency and security.
-
Top 5 Ways that a GRC Portal Simplifies Third-Party Risk Management
Investing in GRC automation technology often benefits power users, but what about occasional users like leaders, contributors and vendors? A well-designed GRC portal can make a world of difference.
Request a Demo to see Onspring in Action
How are third-party risk assessments handled in Onspring?
Native survey functionality within Onspring software allows you to create custom surveys with dynamic questions and branching logic. Survey data from respondents automatically connects to the vendor’s data record and feeds into reports and dashboards. This means you can maintain real-time visibility of risk levels across your vendor universe without manual reporting effort. Surveys can be sent on a schedule or sent ad hoc for each individual vendor based on evaluation requirements of risk volatility.
If someone needs to complete a third-party risk assessment once or twice a year, do they need to be a licensed user?
No. Risk assessments sent via survey do not require users to log into Onspring software. Your vendors and contractors simply complete an online survey through a link sent via email. No login is required and all data submitted remains confidential in Onspring.
What kind of third-party data can we report on?
In Onspring, you can report on any data point captured. Customers using Onspring’s third-party risk management software most often create reports that display aggregated risk scores by vendor category and spend level. These scores often include feeds from third-party monitoring services to supplement risk assessments with continuous monitoring from cyber and financial angles.
How does automation improve the accuracy of third-party risk management?
Automation enables you to put manual, time-consuming efforts on autopilot, which frees up your time to focus on strategizing, proactive troubleshooting, or addressing mitigation efforts. The accuracy of your third-party risk program increases from continuous real-time monitoring of your third-party’s activities.
With automated risk assessments and mitigation task notifications, information is now fed directly into one, consolidated, analytics dashboard. Your program has more data more often, and this data is already displayed in meaningful reports that enable you to activate mitigation activities as needed.
Does Onspring’s GRC platform integrate with other business systems?
Yes. Onspring supports integration with systems like Docusign, Microsoft 365, Google Drive, Slack and many more. Expand Onspring’s capabilities further by integrating it with other systems through the Onspring API.
Can we implement Onspring’s GRC Suite ourselves?
Yes. You can implement Onspring on your own once a designated administrator from your organization completes training. However, most customers choose to have Onspring implement for them, as that service is included when you purchase the GRC Suite with some licensing models.
What kind of software training does Onspring offer?
Onspring offers multiple types of training, which can be combined for an ongoing learning experience:
- Onspring Essentials: This immersive class for administrators teaches the fundamentals of configuration and best practices for end-user adoption.
- Bootcamps: These focused training classes for administrators dive deep into specific Onspring features to help you achieve your goals for data management, process automation, and reporting.
- Web Training: On-demand videos are available 24/7 so you can learn to use Onspring on your schedule. Topics include configuring apps, importing data, creating surveys, using formulas, automating processes, and more.
- Free Friday Training: The name says it all. It’s free and held on Fridays twice per month. These 30-minute remote learning sessions often highlight new features so you always know what’s available for use.
Related Products
A robust set of connected programs that scale as your GRC ecosystem expands and adapts as your business addresses change.
GRC Suite
- Manage frameworks
- Automate workflows
- Real-time monitoring
Risk
- Central risk register
- Automate assessments
- Prioritize risk analyses