Reference
Third-Party Risk Scoring glossary
Terms used in Third-Party Risk Scoring and its documentation.
Applies to Third-Party Risk Scoring as it works today. Moraph updates the platform continuously, and this page is reviewed when it changes.
Terms used in Third-Party Risk Scoring and its documentation.
| Term | Meaning |
|---|---|
| Security rating | BitSight's rating of an organization's security posture, based on externally observable evidence. |
| Risk vector | A category of evidence behind a rating, such as compromised systems, exposed services or patching. |
| Finding | A specific observation in a risk vector that affects an organization's rating. |
| Portfolio | The set of vendors and other third parties your subscription monitors. |
| Tier | A vendor's criticality group, which sets its alert thresholds. |
| Alert triage | Moraph's review of an alert to check the evidence and class it before it reaches a relationship owner. |
| Attribution | Whether a finding truly belongs to the vendor it is shown against, rather than shared or changed infrastructure. |
| Follow-up | The tracked work from a material finding to the vendor's response and an outcome. |
| Risk acceptance | Your organization's recorded decision to accept the risk of an unresolved finding. |
| Pre-contract rating | A rating of a prospective vendor requested before a contract is signed. |
Was this page helpful?
Report a problem with this page
Need help with your own setup rather than this page? Raise a support ticket.