Vendor assessment matrix
See every vendor on the likelihood and impact matrix of your risk settings, before and after treatment, and find the ones that sit outside your appetite.
The matrix plots every rated vendor that is not archived (offboarded ones included) by its likelihood and its impact. It uses the same scales and cells as your risks. It can show both ratings of a vendor, before and after treatment. The distance between the two is the reduction your treatment should bring. A large distance with few treatment actions implemented is a reduction you have planned but not yet reached.
The scales, the levels and which cells fall in which level come from Risks → Settings; by default a five-by-five matrix with the levels low, medium, high and critical. Change the settings and the vendor matrix changes with them.
The three readings
The tabs above the matrix switch between three readings of the same vendors.
Heat map counts vendors per cell, tinted by the cell's level. The toggle below it chooses which rating is counted: Inherent, Residual or Both. Select a cell to list its vendors in the panel beside the matrix, from where each one opens; Open register view opens the vendor list. The strip below shows the Distribution after treatment across the levels and the posture of all of the organization's Treatment actions, not only those linked to vendors: open, planned, in progress and implemented.
Drift sets inherent and residual exposure side by side and names the Biggest movers: the vendors whose treatment moves them furthest.
Plot places every vendor as a point on continuous axes. Where several vendors share a point, they show as one larger bubble. Beside the plot, it lists the vendors in a level that is Not acceptable and the Top exposure. Owned by me narrows the plot to the vendors whose owner role you hold.
What the matrix cannot tell you
The matrix shows ratings, not evidence. A vendor sits in a low cell because someone rated it so. The rating is only as good as the last assessment. Read the matrix together with the overview, which says which of those ratings are overdue for a look.
How is this guide?
Vendor assessments
Assess a vendor on a schedule, in-house or by sending the questionnaire to the vendor over a secure link, and let devguard open the next reassessment when it falls due.
Vendor questionnaire templates
Build the questionnaires you send to suppliers, start from VSAQ, CAIQ or devguard's own templates, write a long one as plain text, and move questionnaires between organizations as JSON.