Adding a relationship
Go to Third Parties → Relationships in the left sidebar and select Add relationship.1
Search for your vendor
Type the vendor’s name in the search field. VISO TRUST searches its directory of thousands of known organizations.If the vendor isn’t in the directory, select Create new third-party organization at the bottom of the results and enter the vendor’s name and website URL.
Risk analysis is significantly more accurate when you provide a vendor website. Always include the URL if you have it.
2
Assign a Business Owner
Select the internal team member who will own this relationship. The Business Owner manages assessments, responds to advisories, and receives notifications for this vendor. You can assign an existing user or invite a new one.
3
Define a business purpose
Write 1–3 sentences describing how your organization uses this vendor: what they provide, how your team engages with them, and what systems or data may be involved. This helps VISO TRUST predict the right risk context and is visible only to internal users, not the vendor.
4
Add details
- Relationship name — customize to differentiate this relationship from others with the same vendor
- Tags — add labels to organize and filter the relationship (see Tags)
- Tier (optional) — assign the vendor to a priority tier (see Vendor Tiers)
5
Enable instant assessment
Leave Predict relationship context and instantly assess checked to have VISO TRUST immediately analyze the vendor using publicly available data. This gives you a risk score within seconds of creating the relationship, with no vendor involvement required.To disable instant assessment by default for all new relationships, go to Settings → Assessments.
Configuring relationship context
Context defines the threat surface and controls in scope for a relationship. It’s made up of two components: Business Cases: how your organization engages with the vendor. Examples: SaaS provider, payment processor, IT support. Each selected business case brings relevant security controls into scope for the assessment. Data Types: what information is shared with the vendor. Examples: Customer PII, financial data, internal business data. Data types determine data sensitivity and drive impact scoring. Together, these two inputs define the relationship’s inherent risk and the controls that need to be assessed. To configure context:- Open the relationship and select the gear icon in the relationship header
- Navigate to Context
- Select the relevant business cases and data types
Products & services scoping
When a vendor offers multiple distinct products or services, you can create a separate relationship for each one. Each relationship has its own assessment context, so artifacts and risk findings are scoped to the specific product being assessed rather than the vendor as a whole. This is especially useful for large platforms (cloud providers, productivity suites, AI tools) where different products carry meaningfully different risks. Vendor-level metadata (company details, profile information) is shared across all relationships with the same organization, so you don’t need to duplicate it.Tags
Tags are labels you apply to relationships for filtering and organization. Use them to group vendors by category, program phase, team ownership, or any other dimension that fits your workflow. Tags are available as filters on the Relationships list page and on individual relationship detail pages. To manage your organization’s tag library, go to Settings → Tags.Vendor Tiers
Vendor Tiers let you group relationships into up to five priority tiers for portfolio-level oversight. Tiers are useful for defining treatment standards, reporting segmentation, and prioritization criteria. You configure tiers in Settings → Tiers, where you select how many tiers your program uses and describe each one. See Vendor Tiers for the full setup. You can assign relationships to a tier in two ways. Select them on the Relationships list page and use the Move tier action. Or open a single relationship’s Relationship configuration dialog and select a tier under Tier.Saved filters
Saved filters let you store a filter selection on the Relationships list page and reapply it with one click. Use them for views you return to often, such as a specific tier, business owner, or tag combination. Saved filters are stored on your VISO TRUST account, so they’re available from any browser or device you log in from. VISO TRUST automatically moves filters you previously saved in your browser to your account the first time you open the Relationships page. To save a filter:- Open the filter panel on the Relationships list page and select your criteria
- Select whether relationships must match all criteria or any of them
- Open the Saved filters menu and select Save current selection
- Enter a name and save
Bulk actions on relationships
Select multiple relationships on the Relationships list page to apply changes across them at once. The toolbar exposes four bulk actions:- Move tier — assign the selected relationships to a Vendor Tier (Admin only).
- Assign assessment lead — set the Assessment Lead on the selected relationships.
- Assign business owner — set the Business Owner on the selected relationships. You can select only existing users in bulk; use the individual relationship dialog if you need to invite a new user.
- Manage subscribers — add or remove Subscribers across the selected relationships in one operation.
Exporting relationship data
You can download CSV exports of your relationship data from the Relationships list page. Open the ⋮ (more options) menu next to the view toggle and select an export:- Export relationships — one row per relationship, including status, inherent and residual risk, assessment phase and dates, business owner, tags, tier, and security ratings.
- Export nth parties — one row for each relationship and nth-party pair, with Relationship ID, Relationship, and Nth party columns. An nth party is a subservicer or technology provider your direct vendor relies on, surfaced through the Risk Network.
Pending Changes
Pending Changes appear on a relationship when new information exists that isn’t yet reflected in the current assessment summary. VISO TRUST lists them in two groups. Program updates: something changed in your organization’s configuration, so scores across the portfolio may shift:
Assessment updates: something changed on this relationship:
Most entries link to the tab where the change happened: artifact entries open the Artifacts tab, advisories open Monitoring, and scope and questionnaire entries open Details. Program updates have no target because nothing on the relationship itself changed.
Pending changes don’t require immediate action. VISO TRUST incorporates them the next time an assessment update runs. To resolve them immediately, initiate a public search from the relationship.
Relationship lifecycle
You set a relationship’s lifecycle status in the Relationship configuration dialog (gear icon) under Onboarding and lifecycle management. The available statuses are:- Not Onboarded is the default for new relationships. The vendor doesn’t appear in Risk Insights dashboards and isn’t eligible for lifecycle automation.
- Onboarded includes the vendor in Risk Insights dashboards and enables lifecycle management features like recertification scheduling and automatic artifact renewal.
- Archived hides the relationship from the default Relationships list view and from Risk Insights, and stops lifecycle automation. History, artifacts, and audit trail are retained.