Vendor risk

Vendor risk management in Keel

Your security is only as good as the vendors you rely on. Keel keeps a living inventory of the third parties that touch your data or systems, with a risk rating and a review cadence for each, so third-party risk is managed rather than remembered.

Build your vendor inventory

In Vendors, add each third party with what it does, the data it can access, and how critical it is to your operations. Tiering vendors (for example critical, important, or low) lets you focus your effort where a failure would actually hurt.

The Add tab on Vendors offers three ways in:

Add by website: paste the vendor’s site and Keel drafts the profile, with its category, likely data access and a suggested criticality tier, for you to review. It uses AI credits.
Import from CSV: one row per vendor, with a header row in any column order. Only name is required; the other columns are website, contact, tier, status, data access and notes. The tab links a template. An import that would take you past your plan’s vendor limit adds nothing and tells you how much room is left.
Add manually: name, website, security contact, the data the vendor accesses, an inherent criticality tier and status, and the vendor’s access controls (MFA, password policy, SSO).

Starting from nothing is the hardest part. Vendor discovery reads the records your domain already publishes and proposes the vendors they name, with the evidence for each, so the first version of your inventory is something you review rather than something you remember.

Inherent and residual risk

As with your risk register, Keel captures two views of vendor risk:

Inherent risk: how much risk the vendor represents based on the data and access it has.
Residual risk: how much remains once you account for the vendor’s own controls and the safeguards you have in place.

Residual criticality is the inherent tier reduced by the access controls you record for the vendor. When a vendor’s assessment reflects strong controls, its residual risk drops accordingly, so your inventory shows where the real exposure is rather than treating every vendor the same.

Assess with questionnaires

Send or record a security assessment for each vendor. Keel’s questionnaire automation can help you work through assessments faster, and the results feed the vendor’s risk rating so the score is grounded in evidence, not a guess.

Questionnaires you send

Questionnaires you send lists every questionnaire this workspace has created for a vendor, drafts included, across all vendors. Undecided ones come first, then by due date. Needs attention narrows the list to the ones still waiting on a decision.

Owners and admins can send one questionnaire to several vendors at once. Pick the questionnaire and the vendors, and Keel creates one draft per vendor. Nothing is sent until you press Send on a draft’s row, where you can also set a due date. A wrong selection costs a deleted draft, not an email you cannot take back.

The page shows up to 200 questionnaires. Open a vendor to see all of theirs. Questionnaires that customers and prospects send to you are under Questionnaires you receive.

Questionnaire templates

Your questionnaire templates holds the questionnaires this workspace saves to reuse. Nobody outside the workspace can see them. Owners and admins create one under New template by naming it and choosing which of Keel’s built-in questionnaires to start from. Replace questions with… on a template’s row swaps in another built-in set.

A template appears first in the questionnaire picker under Questionnaires you send. Sending it copies its questions into each vendor’s assessment, so editing the template later never changes an assessment a vendor has already started. Archive a template to hide it from the picker without deleting it.

SOC reports

Open a vendor and choose Manage SOC reports to record each SOC report they send you: the type (SOC 1 or SOC 2, Type I or Type II, or SOC 3), the audit firm, the report period, any bridge letter, whether the auditor noted exceptions, and the complementary user entity controls (CUECs) the report expects you to run. For a Type I report, enter its as-of date as the period end.

Keel marks each report by how current it is:

Status	Meaning
Current	Today falls inside the report period or a bridge letter’s date.
Needs a bridge letter	The period has ended and no bridge letter covers today.
Over 12 months old	The period ended more than 12 months ago. Ask for the next report.

The AICPA sets no expiry date for a SOC report. The 12-month line is the working rule most vendor reviews use, and a bridge letter does not extend it.

Review on a cadence

Vendor risk is not a one-time check. Keel tracks a review date for each vendor and surfaces which reviews are due or overdue, so re-assessments happen on schedule and your inventory stays current between audits.

After a review session, tick the vendors you covered and choose Mark reviewed from the bar to stamp them all at once. Each one’s next review date moves out by its own cadence. The same bar can remove several vendors together.

Next steps

Vendor discovery: build the first draft of your inventory from public records.
Evidence: store assessment results and supporting documents.
Risk register: roll vendor exposure into your overall risk picture.
Trust Center: show prospects how you manage third-party risk.