Security, data and compliance in Vendor Risk Management (VRM)

How Vendor Risk Management (VRM) protects data and supports your compliance obligations.

Security controls

Single sign-on

Staff authenticate through your identity provider, so your own access policies and multi-factor requirements apply.

Role-based access

What each person can see and change follows their role, and sensitive documents can be limited to named reviewers.

Vendor links

Upload links are specific to one request and one vendor, and give no access to other vendors or your records.

Encryption

Client data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization, as described in our Trust Center.

Audit trail

Every change to a vendor, document, review or issue is recorded with who made it and when.

Company-wide assurance

The product runs under the same controls as the rest of Moraph, which are independently audited to SOC 2 Type II and ISO/IEC 27001.

Requirements it supports

• Interagency Guidance on Third-Party Relationships: Risk Management
• NCUA guidance on evaluating third-party relationships
• FFIEC IT Examination Handbook (Outsourcing Technology Services)
• FFIEC Business Continuity Management booklet
• Gramm-Leach-Bliley Act safeguards for customer information

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted by Moraph in the United States, United Kingdom or Australia region.
• Dedicated environment: Single-tenant hosting where your policies require it, scoped in the proposal.
• With a managed service: Optionally run alongside a Moraph managed service for platform administration and configuration changes.

Limitations

• It organizes and evidences due diligence. The risk decisions are made by your reviewers.
• It does not continuously scan vendors' internet-facing systems or financial health. Reports from rating services you subscribe to can be attached to the vendor's record.
• Questionnaire content and tiering rules are set up with you during implementation and owned by your team afterwards.
• It does not read SOC reports for you. Reviewers record the scope, exceptions and controls using the review template.
• It is not a contract management system. It records key dates and terms and links to the agreement held elsewhere.
• It does not manage purchasing, invoices or payments to vendors.
• Vendors must respond to requests themselves. The product reminds and escalates but cannot obtain documents a vendor declines to provide.
• Fourth parties are recorded as listed by your vendors; the product does not discover them independently.