Assessments

An assessment is how VISO TRUST evaluates a vendor’s security posture and produces a risk score. Depending on how much depth you need, assessments can run automatically, start when you initiate them, or involve the vendor directly.

​

Assessment types

​

Starting an assessment

From any relationship, click Start assessment (or Update assessment if one already exists) to begin. To add documents without starting a new collection, use Add information.

​

Request artifacts from the vendor

Send a collection request to the vendor’s contact:

• Ask for everything — VISO TRUST requests all artifacts and questionnaire responses needed to satisfy in-scope controls
• Request specific artifacts — specify which document types you need (e.g., SOC 2, ISO 27001, pen test)
• Request manual response — send a questionnaire for the vendor to answer in writing

You can mix and match these options in a single collection request.

​

Upload artifacts directly

If you already have documentation, upload it directly without involving the vendor. VISO TRUST classifies the artifact type and begins analysis immediately. You can upload artifacts at any time, even alongside an active collection request.

​

Conduct research

VISO TRUST can automatically search public sources for the vendor, finding compliance attestations, publicly available artifacts, risk advisories, and other relevant data. This runs automatically for instant assessments and you can trigger it manually at any time. VISO TRUST adds public artifacts to all of your relationships with the vendor, and to their open assessments, as soon as it finds them. You don’t have to wait for the research to finish before you see them. If a security scan flags a public artifact’s URL as malicious, or can’t scan it, VISO TRUST removes that artifact from your relationships and assessments. VISO TRUST doesn’t add it again.

​

Assessment phases

Assessments move through a defined lifecycle. Understanding each phase helps you know what actions are available and what’s happening behind the scenes.

​

Follow-up questionnaires

If controls remain unvalidated after initial review, VISO TRUST surfaces a follow-up questionnaire to request additional information from the vendor. You can configure this behavior in three ways:

• Always ask before following up — review results and decide whether to follow up
• Conditional based on residual risk — automatically follow up if residual risk meets a threshold (e.g., Medium or above)
• Use assessment concierge service — VISO TRUST manages the follow-up on your behalf

You can configure this setting at the assessment, relationship, or organization level.

​

Send a follow-up request

When an assessment reaches Follow-Up Recommended, open the Request follow-up dialog from the relationship page. Use it to choose what you ask the vendor and who receives it.

1. Under Request vendor response, review the control domains that VISO TRUST preselected. Each group, such as Security or Privacy, lists its Insufficient control domains first, labeled Recommended. Each supplemental questionnaire appears as its own group of questions.
2. Select or clear control domains and supplemental questions to set the scope. Click Show sufficient control domains to add domains that already have enough evidence. Click Reset to recommended scope to restore the preselected scope.
3. Under Who should we send this request to?, confirm or change the third-party contact. If you change it, the new contact becomes the relationship’s primary contact and receives the follow-up.
4. Optionally, add a personal message of up to 2,000 characters. VISO TRUST includes it in the follow-up email and in the Comment on the follow-up request receipt.
5. Under Follow-up deadline, pick the date the vendor must respond by. The date defaults to the assessment’s follow-up questionnaire timeline and must be after today.
6. Click Send follow-up request.

You must select at least one control domain or question to send the request. To finish without a follow-up, click Skip and complete assessment.

​

The vendor experience

When you send a collection request, the vendor receives an email with a secure link and a one-time passcode. Through the collection portal, they can:

1. Review what’s being requested and access guidance on typical artifacts for each control
2. Upload documents (SOC 2, ISO 27001, pen tests, DPAs, etc.)
3. Answer questionnaires if requested
4. Forward the request to the right internal contact if needed
5. Certify and submit their response when complete

After submission, VISO TRUST processes the artifacts using AI to classify, analyze, and map findings to your control framework. For a step-by-step walkthrough of the collection portal, including forwarding the request, requesting more time, and opting out, see The Vendor Experience. To share with a vendor, point them at Responding to a VISO TRUST Request: Vendor’s Guide, the same process written for their side.

​

Collection timelines and reminders

The default collection window is 30 days. VISO TRUST sends reminders automatically:

• Internal recipients (the Business Owner, Assessment Lead, Subscribers, and the assessment creator): every 5 business days
• Vendor contacts: every 3 days, with a final notice 3 days before the deadline

You can toggle each internal recipient on or off for the Assessment reminder notification in the settings matrix under Settings → Org Profile → Notifications. See Notifications & Alerts. You can extend the collection timeline at any time while an assessment is in the Collecting Information phase. There’s no limit on extensions. If the vendor doesn’t respond by the deadline, the assessment moves to the Expired phase. What happens next depends on the No-vendor-response setting configured under Assessment Settings:

• Notify me — the assessment stays in the Expired phase and shows an Assessment expired banner on the timeline. From the Take action menu, select:
  • Extend timeline — return the assessment to Collecting Information with a new deadline, giving the vendor more time to submit
  • Complete assessment — close the collection request and move the assessment to Completed using whatever evidence has been gathered so far
• Close collection request — VISO TRUST automatically completes the assessment. The timeline records an Expired node before Completed so you can see why the collection ended.

On the Relationships list, expired assessments show an Expired phase chip, and you can filter the list by that phase. Expired assessment events also appear in the relationship’s audit log and activity feed.

​

If the vendor email bounces

If the email to the vendor’s contact bounces, the assessment timeline shows an Email delivery failed banner. Admins, Program Managers, and Contributors with edit access to the relationship can act from the banner. Viewers see the banner without the actions.

• Update contact: change the vendor contact’s email when the address is misspelled or no longer active.
• Retry: reactivate the address and resend the request when you believe the address is correct. If the assessment is still active, VISO TRUST resends the request to the original recipient.

VISO TRUST blocks Retry when the address hard bounced more than three times in the last 30 days, or when the email provider has permanently blocked it. In those cases, click Update contact and enter a different email.

​

Sub-processor collection

When the Privacy risk dimension is in scope, VISO TRUST prompts vendors to provide a list of their sub-processors (third parties that process personal data on your behalf). VISO TRUST displays sub-processors in the risk analysis on the relationship’s Assessments tab and maps them in the relationship’s graph view for nth-party visibility. In the risk analysis, the collected list appears as a table under the Sub-Processor List control, showing each company, its purpose, and its location of processing. A collected list counts as full-assurance evidence, so VISO TRUST treats the Sub-Processor List control as fully mitigated once the vendor provides it.

​

Reviewing and acting on results

When an assessment reaches Completed status, a Review risk action becomes available, indicating that findings are ready and your team needs to record a decision.

​

Review risk actions

Once you send a remediation request and the vendor responds, VISO TRUST automatically starts a new assessment update and returns the relationship to Review Risk for re-evaluation.

​

Viewing sent requests

Use a request receipt to check exactly what you asked a vendor for. For example, check it before you send a reminder, answer a vendor question, or audit an assessment. VISO TRUST saves a receipt each time you send a collection, follow-up, or remediation request. To open a receipt, expand Assessment details on the relationship page. Then click a link in the Requests row. The row shows one link per request type: Collection request, Follow-up request, and Remediation request. VISO TRUST hides a link if no request of that type was sent. The receipt opens in a side panel. If you sent several requests of the same type, they stack newest first. The newest one starts expanded. Each receipt shows:

• Sent by, Sent to, and Sent on
• Expiration date for collection and follow-up requests, or Target date for remediation for remediation requests
• Any Comment included with the request
• A status label if the request was Cancelled, Declined, or No longer applies

Below the header, the receipt lists what you requested: For the newest receipt of each type, the recipient, date, and status reflect the current assessment. All other content stays exactly as it was sent. Older receipts show what the vendor saw at the time.

​

Viewing past assessments

The Assessments tab holds the relationship’s assessment history: every assessment except cancelled ones. Use the selector at the top of the tab to switch between them; the risk analysis, control evidence, and summary below it all update to the assessment you select. Each assessment is a snapshot. Selecting an older one shows the evidence and scores as they stood when it completed, not today’s picture, so you can see exactly what a past decision was based on. See Risk Analysis for how to read it.

​

Assessment completion

VISO TRUST marks an assessment Completed when:

• All submitted artifacts and questionnaire responses have been analyzed
• Any follow-up questionnaire has been responded to, skipped, or determined unnecessary
• An assessment summary has been generated

Completion does not mean no action is required. You still need to review risk and record a decision.

​

If summary generation fails

If the assessment summary fails to generate, the latest assessment shows a “We couldn’t generate this summary” alert. When a previous summary exists, it remains visible below the alert until VISO TRUST generates a new one. Click Try again to regenerate the summary from the current assessment data. The action is available to the relationship’s Business Owner, the Assessment Lead, and Admins. If generation keeps failing, contact support@visotrust.com.

​

Lifecycle management

For onboarded relationships, VISO TRUST can automate ongoing vendor management: Lifecycle management has two independent switches (Artifact updates and Recertification). Each one asks whether VISO TRUST should remind your team or contact the vendor itself. Artifact updates: VISO TRUST tracks when artifacts expire and acts 30 days before expiration. Turn the switch on and select:

• Remind this business owner to request updated artifacts — VISO TRUST notifies the Business Owner and leaves the request to them
• Automatically contact the third party to collect updated artifacts — VISO TRUST opens the collection request itself

The panel shows the next expiration date it’s working from (Next artifact valid until …). VISO TRUST sends one automatic update request per expiration window. If you cancel that assessment, VISO TRUST does not create another automatic request for the same expiring artifacts. You can start an assessment manually at any time. Recertification: schedule recurring reassessments. Turn the switch on and set:

• Based on — the date the schedule counts from, with a Reset to last assessed date shortcut
• Frequency — Every 3 months, Every 6 months, Every year, Every 2 years, or Every 3 years
• Whether to Remind this business owner to review the relationship and start recertification, or Automatically contact the third party 30 days before the recertification date

VISO TRUST starts one automatic assessment per recertification cycle. If you cancel a recertification assessment, including one you started manually within 30 days of the recertification date, VISO TRUST does not start another automatic assessment for that cycle. The relationship stays overdue until you start an assessment manually or advance its recertification date, which begins a new cycle. Lifecycle management settings are in the relationship’s Relationship configuration dialog (gear icon) under Onboarding and lifecycle management.