Relationship Configuration Settings

Relationships and Assessments: Configuration

Overview

This guide covers the full lifecycle of a vendor relationship in VISO TRUST — from creating a relationship and configuring its settings, through the assessment process, to risk review and ongoing lifecycle management. Use it as a single reference for understanding how all the pieces connect.

The End-to-End Flow

Creating a Relationship

How you create a relationship in VISO TRUST depends on whether the vendor already exists in the system. There are two paths.

Path A: The Third-Party is in the directory (URL already in VISO TRUST)

When you begin creating a relationship, VISO TRUST checks whether the vendor's website URL is already known. If it is, the vendor appears as a recommended option and you can select it directly.

Because the URL is already available, VISO TRUST can immediately offer to predict relationship context and instantly assess — automatically analyzing vendor context, predicting inherent risk, and gathering intelligence from publicly available sources.

Note: VISO TRUST performs an instant assessment for vendors even if they are not in the directory, as long as a URL is provided.

What you configure during relationship creation (Table 1):

What happens next:

With the toggle on, VISO TRUST immediately begins the instant assessment. The assessment moves through these steps automatically:

1. Predicting context — VISO TRUST predicts the relationship context based on the vendor's profile
2. Researching vendor — public sources, certifications, breach history, and risk advisories are analyzed
3. AI processing — findings are processed and risk is calculated
4. Completed — assessment is finalized (typically within seconds to a few minutes)
5. Risk reviewed — pending your action

Once completed, you have three options:

• Review risk — accept the risk, override the risk value, or request remediation if the assessment identified recommendations
• Request auditor review — if you want a human auditor to review the available artifacts, click the auditor icon on the assessment to submit a request
• Update assessment — start an additional assessment using one of three methods:

a) Request information — send a collection request to the vendor for additional artifacts and questionnaire responses

b) Add information — upload artifacts you already have directly

c) Conduct research — initiate a new public search assessment

Path B: New third-party organization (URL not in system)

If the vendor is not found as a recommended option, you are creating a brand new third-party organization in VISO TRUST. If the URL is not provided- the context prediction and Instant assessment cannot run automatically.

You can configure the fields as shown in Table 1 (above) during relationship creation.

Before an assessment can begin, you must first add relationship context.

1. Click Add context on the relationship to define the scope — this tells VISO TRUST how you plan to do business with the vendor and determines the inherent risk and controls in scope
2. Once context is added, you can initiate an assessment using any of the three methods:

• Conduct research — analyze public artifacts, certifications, breach history, and risk advisories to generate risk insights automatically
• Add information — upload vendor artifacts or links to resources you already have
• Send a collection request — collect artifacts and questionnaire responses directly from the vendor
  
  Note: Public artifacts search is included in every assessment when a URL is provided.

Part 1: Relationship Configuration

Every vendor relationship has a configuration panel accessible by clicking the gear icon in the relationship header, or the edit (pencil) icon next to any section on the Details tab.

The configuration panel is organized into three sections: Relationship, Context, and Assessments.

Relationship

Relationship details

Contacts

Onboarding and lifecycle management

Note: You can select multiple relationships from the Relationships List Page to archive them in bulk.

Context

Relationship context defines the threat surface, controls in scope, and data sensitivity for a vendor. Configuring context enables VISO TRUST to tailor assessments and accurately determine inherent risk.

Context is configured across three sub-sections:

Intake questionnaire

Captures how the vendor is used — what systems they connect to, what processes they support, and what their role is. Used to predict inherent risk and scope the right controls.

Data classification

Specifies the types and sensitivity of data shared with the vendor. VISO TRUST uses this to calibrate the data sensitivity dimension of the risk model.

👉 Learn more about Data Types and Impact

Supplemental questionnaires

Assigns specific questionnaires to be sent during the assessment. You can configure questionnaires to apply globally to all relationships, or assign them individually here.

👉 Learn more about Questionnaires

Once context is configured, you can initiate an assessment:

Assessments

Assessment settings control how collections are run for this specific relationship. Settings configured here override organization-level defaults for all new assessments on this relationship.

Collection defaults

Analysis method

Part 2: Assessment Phases

Once a relationship is configured, assessments move through a defined set of phases depending on how they were initiated.

👉 Learn more about Assessment Phases

Assessment paths

• Conduct Research

VISO TRUST searches public sources for artifacts, compliance attestations, and risk advisories. Discovered artifacts are analyzed by AI. No vendor involvement is required. The assessment reaches Completed using publicly available information.

• Add Information

Artifacts are uploaded directly on behalf of the vendor — no vendor portal involved. Analysis begins immediately using the configured analysis method (AI or AI + Auditor). The assessment reaches Completed.

• Request Information (no control gaps)

1. Started — collection portal link emailed to vendor
2. Collecting information — vendor opens portal and begins submitting
3. Review started — vendor submits; VISO TRUST begins analysis
4. Completed

• Request Information (control gaps identified)

1. Started
2. Collecting information
3. Review started
4. Follow-up recommended — gaps identified that could reduce residual risk
5. Follow-up sent (optional) — vendor receives a missing controls questionnaire; timeline can be configured
6. Completed — follow-up processed, or skipped

Note:

• You can extend the follow up timeline at anytime during the assessment when it is in collecting info.
• You can upload artifacts at any phase. If an assessment is already Completed, uploading new artifacts starts a new assessment automatically.

Part 3: Risk Review

Once an assessment reaches Completed, it automatically moves to Review Risk status. Your team then has three actions available from the Review Risk button in the assessment summary.

👉 Learn more about Risk Review and Acceptance Process

Part 4: Lifecycle Management

For ongoing relationships, lifecycle management automates the process of keeping assessments and documentation current.

Artifact validity

• VISO TRUST monitors artifact expiry dates and triggers outreach 30 days before expiry
• Choose whether to remind the business owner to provide updated artifacts, or have VISO TRUST contact the vendor directly

Recertification

• Set a start date and frequency (e.g., annually) to schedule periodic re-assessment
• Choose whether to remind the internal owner or automatically reach out to the vendor
• When a recertification is triggered, a new assessment update is started automatically (or a reminder is sent, depending on your configuration)
• Organization-level assessment defaults apply to all lifecycle-triggered assessments

Onboarding

1. Select a Not Onboarded relationship from your list
2. Click the Not Onboarded dropdown and select Onboard