CQ Vendor Risk
Connect Vendor Evidence, Risk, Ownership and Action.
CQ Vendor Risk is third-party risk management software that helps organizations assess supplier cyber risks, manage vendor due diligence, track remediation, and maintain accountable oversight throughout the vendor lifecycle. From assessment evidence to executive decisions, it brings third-party risk information into one governed environment.
A structured operating environment for third-party cyber risk.
CQ Vendor Risk keeps vendor context, due diligence, evidence, findings, ownership, treatment, approvals, and review history within one governed vendor risk management lifecycle.
Keep the relationship and risk context together.
Maintain business ownership, criticality, services, review status, and relevant vendor history within the same record.
Connect due diligence to supporting evidence.
Structure questionnaires, evidence collection, review activity, findings, and assessment records around the vendor relationship.
Keep action, approval, and accountability visible.
Record remediation, treatment direction, owners, deadlines, approvals, and current status alongside the underlying risk information.
Third-party cyber risk changes across the vendor relationship.
Vendors may handle company data, access systems, support critical operations, or provide services that require ongoing security oversight.
Effective vendor risk management depends on keeping business context, evidence, findings, ownership, treatment, approvals, and review history connected over time.
One governed third-party risk lifecycle.
Move from vendor context through due diligence, risk treatment, and ongoing oversight in one structured TPRM process.
Establish the relationship
Capture business ownership, services, criticality, data or system access, and the context required for review.
Assess the vendor
Run structured vendor due diligence, collect supporting evidence, document findings, and retain review records.
Assign action
Connect identified third-party risk to remediation, treatment direction, accountable owners, deadlines, and approvals.
Maintain governance
Track current status, reassessment, open actions, reporting, and the history required for ongoing vendor oversight.
Capabilities across the vendor risk management lifecycle.
The product combines the records, workflows, and evidence required for structured third-party cyber risk management.
Maintain a governed vendor inventory.
Keep business context, ownership, criticality, lifecycle status, review information, and vendor history in one controlled record.
Structure vendor assessments and evidence.
Support due diligence with questionnaires, evidence collection, assessment records, findings, and clear review ownership.
Connect findings to treatment and accountable action.
Keep risk records, remediation actions, treatment direction, owners, deadlines, approvals, and status connected to the vendor record.
Maintain current vendor risk oversight.
Support reassessment, monitoring, reporting, and audit preparation while retaining the context behind previous reviews, actions, and approvals.
Complete Product. Pay for Scale, Not Features.
CQ Vendor Risk delivers its full product capabilities from day one, without feature-based tiers or functionality restrictions.
Our licensing model is designed to accommodate organizations of different sizes and operational needs. Pricing scales transparently with the number of users and vendors managed, allowing organizations to expand capacity as their requirements evolve.
Full functionality. Flexible capacity. Predictable pricing.
One vendor record. Different responsibilities.
The same third-party risk information supports procurement, security, risk leadership, and executive oversight without duplicating the underlying vendor record.
Manage review and obligations.
Keep vendor ownership, review status, required security information, approvals, and follow-up connected to the relationship.
Review evidence and treatment.
Work with vendor assessments, supporting evidence, findings, remediation, and current third-party cyber risk status.
Maintain third-party risk oversight.
Review critical vendors, open findings, treatment status, ownership, reassessment, and risk history from one governed view.
See material vendor exposure.
Review critical third parties, current risk status, accountability, treatment direction, and outstanding actions at management level.
Keep the evidence behind each vendor risk decision.
CQ Vendor Risk retains the vendor context, assessment evidence, findings, ownership, treatment, approvals, and review history associated with third-party risk records for governance review and audit preparation.
Keep questionnaires, supporting evidence, assessment records, and findings connected to the vendor record.
Maintain visible responsibility for vendor review, remediation, risk treatment, and follow-up.
Retain remediation actions, treatment direction, approvals, deadlines, and current status.
Preserve review, reassessment, action, and approval history for management and audit review.
CQ Vendor Risk — Frequently Asked Questions
Practical answers about third-party risk management software, vendor assessments, cybersecurity governance, and licensing.
What is third-party risk management software, and why would we need it?
Most organizations rely on outside parties for important services, including hosting, payroll, software development, and payment processing. Each supplier can introduce cybersecurity risks, yet many organizations still manage these relationships through spreadsheets, email threads, and disconnected records.
Third-party risk management (TPRM) software provides one place to maintain vendor records, conduct assessments, store supporting evidence, document findings, and track corrective actions.
It also helps organizations demonstrate what was reviewed, when, and by whom to auditors, regulators, and management.
What does CQ Vendor Risk actually do?
CQ Vendor Risk keeps information about each supplier in one governed record and organizes assessments into structured phases with documented approvals.
The process begins with the business relationship rather than the questionnaire. Vendors are classified according to their criticality, services, and the organization's dependence on them.
Vendor tier and type inform which security control objectives and assessment questions are relevant. Questions that do not apply to the vendor's risk profile can be excluded.
Supporting certifications and assurance reports, including ISO 27001, PCI DSS, and SOC 2, can be considered when determining which controls have already been addressed, subject to their validity, scope, and applicability.
Findings, accountable owners, remediation actions, approvals, and decisions remain connected to the vendor record so that subsequent reviews can build on previous assessments.
Will our suppliers have to answer 300 questions?
Only when their risk profile requires it.
CQ Vendor Risk uses vendor tiering, supplier type, and relevant certifications or assurance reports to support a proportionate assessment process.
Lower-risk suppliers may require fewer questions, while critical suppliers with greater exposure or limited supporting evidence may require a more comprehensive assessment.
The objective is to focus assessment effort where the potential business and cybersecurity impact is greatest.
Does the software decide whether a vendor is acceptable?
No. CQ Vendor Risk supports human decision-making rather than replacing it.
The platform proposes relevant security controls based on the vendor's risk context and applicable threats. Control requirements can be reassessed when the threat environment changes.
The responsible business owner or risk analyst evaluates the findings, determines whether the risk is acceptable, documents the reasoning, and records the required approvals.
CQ Vendor Risk maintains the decision history and accountability. It does not make risk acceptance decisions on behalf of the organization.
Is this only about reducing risk?
No. Third-party risk management also supports operational resilience.
For critical suppliers, organizations need to understand whether essential operations can continue or recover if a service provider experiences an outage, disruption, or cybersecurity incident.
Relevant assessment areas may include business continuity, recovery arrangements, exit planning, and supplier substitution.
These considerations are particularly relevant to ICT third-party risk management and operational resilience under DORA.
How does it help with audits?
CQ Vendor Risk maintains assessment phases, findings, supporting evidence, decisions, and approvals in the relevant vendor record.
Dates, responsible individuals, remediation actions, and review history provide traceability throughout the vendor lifecycle.
When auditors or management request evidence of how a supplier was assessed, which risks were identified, and who approved the decisions, the organization can refer to a structured record rather than reconstructing information from multiple sources.
Does it make us compliant with DORA, NIS2, or ISO 27001?
No software product automatically establishes regulatory compliance or ISO 27001 certification.
CQ Vendor Risk supports third-party cybersecurity risk management activities that may be relevant to DORA, NIS2, and ISO 27001, including vendor due diligence, criticality-based assessments, evidence retention, accountability, remediation tracking, and periodic review.
Applicable obligations depend on the organization's sector, jurisdiction, and operating environment.
The software provides structured processes and supporting records; determining and meeting applicable compliance requirements remains the responsibility of the organization.
Is it built for large enterprises or smaller companies?
Both. CQ Vendor Risk supports organizations with different numbers of suppliers, team sizes, and third-party risk management requirements.
Organizations use the same product capabilities regardless of their licensed capacity.
Licensing scales with the number of users and vendors managed. Additional capacity can be added as requirements grow.
There are no feature-restricted Starter or Enterprise editions that require customers to upgrade simply to access additional product functionality.
How is it licensed?
Complete Product. Pay for Scale, Not Features.
CQ Vendor Risk includes full product functionality without feature-based tiers.
Pricing is based on the number of licensed users and vendors managed. Organizations can expand either capacity as their requirements evolve while retaining access to the same product capabilities.
Full functionality. Flexible capacity. Predictable pricing.