Send a VeriSAQ assessment, let each vendor complete it in a scoped portal, and turn the result into a structured, reviewable part of your vendor risk program — connected to ratings, risk decisions, evidence, and audit history instead of a spreadsheet.
Chasing vendor security questionnaires over email and spreadsheets is slow to run and hard to prove later. VeriSAQ is VeriGRC's own vendor security assessment, run end-to-end in your workspace — so the result is connected to the rest of your third-party risk program from the start, not reassembled at audit time.
Not every vendor needs the same depth of review. VeriSAQ gives you a family of assessments so you can match how deeply you review a vendor to how much risk that vendor carries — from a fast baseline for low-risk vendors to a comprehensive review for the ones that matter most. When a vendor needs a closer look in a specific area, companion assessments add focused depth alongside any tier.
For low-risk vendors with limited access to your systems, data, or critical business processes.
A streamlined vendor security assessment that covers the essentials without the overhead. VeriSAQ Lite gives you a quick, consistent read on vendors that don't touch sensitive data or critical operations — so low-risk relationships move fast and still get reviewed.
For common SaaS, service provider, technology, and business vendor relationships.
A standard vendor security assessment for vendors with moderate access to your systems, data, or business processes. VeriSAQ Core gives you a balanced review of security, privacy, vendor management, and operational controls — the default for most of the vendors you work with.
For high-risk or critical vendors with sensitive data access, privileged or production access, customer-impacting services, or significant business dependency.
A comprehensive vendor security assessment that goes deeper across security, privacy, cloud, resilience, and vendor-risk controls. VeriSAQ Extended is built for the vendors whose disruption or compromise would hurt most — the ones that warrant your closest review.
When you need a closer look at a specific area of a vendor's risk, companion assessments layer focused depth onto Lite, Core, or Extended — covering AI systems and AI-related vendor risk, privacy and data governance, cloud and SaaS security, and operational resilience. You assign them alongside a tier when that dimension is in scope, not instead of one.
Send the right assessment, let vendors complete it securely, and turn the result into a scored, connected part of your vendor risk picture.
Send Lite for a fast baseline, Core for standard vendors, or Extended for your most critical vendors — matched to how much risk the vendor carries.
Assessment results can be scored consistently, with supporting context available for your team to review and act on — not just a raw questionnaire to read line by line.
Vendors complete their assigned assessment in a secure portal, seeing only the items assigned to them and nothing else in your organization's workspace.
Assessment responses, scoring context, and supporting materials are organized in one place, so your team can review the result before it feeds ratings, risk decisions, and audit history.
Results can feed vendor security ratings, composite vendor risk scoring, and risk-register decisions — connected on one data model, without manual exports.
Invitations, submissions, scoring activity, and review history are captured in an append-only audit log behind every assessment, so the history stays reviewable over time.
From your invitation to a scored result that feeds the rest of your program.
An authorized user on your team invites the vendor to the VeriSAQ assessment they need to complete.
The vendor accepts the invitation, sets up access, and signs in with a local login or configured single sign-on.
The vendor sees only the VeriSAQ items assigned to them — nothing else in your organization's workspace.
The vendor completes the assessment and uploads supporting evidence directly in the portal, where it stays attached to the record.
The completed assessment is scored in a structured workflow, with results and supporting context available for your team to review before they feed the rest of your program.
Results can feed vendor security ratings, composite vendor risk scoring, and risk-register decisions — with every step captured in the audit history.
VeriSAQ is the assessment step inside third-party risk management. Vendors complete it through the vendor portal, results feed vendor security ratings and risk-register decisions, and the assessment record stays connected to evidence and audit history across the platform.
A vendor security assessment is a structured review of a third party's security practices, controls, evidence, and risk posture. VeriSAQ provides a branded assessment family that helps teams collect responses, organize evidence, and review results as part of the third-party risk lifecycle.
VeriSAQ includes tiered assessment options so teams can match the depth of review to the vendor relationship. Current options include Lite, a streamlined baseline for low-risk vendors with limited access; Core, the standard review for common SaaS, service provider, technology, and business vendors with moderate access; and Extended, a comprehensive review for high-risk or critical vendors with sensitive, privileged, or production access, or significant business dependency. Companion assessments add focused depth in specific areas alongside any tier.
Match the tier to how much risk the vendor carries. Choose Lite when a vendor has limited access to your systems, data, or critical processes. Choose Core for the common vendors with moderate access — the default for most relationships. Choose Extended for vendors with sensitive data access, privileged or production access, customer-impacting services, or significant business dependency. If a vendor needs a closer look in a specific area, add a companion assessment alongside the tier you pick.
Your team invites the vendor, who accepts, sets up access, and signs in to a secure portal with a local login or configured single sign-on. The vendor sees only the assigned assessment, completes it, and uploads evidence directly — with every action tracked and auditable.
Each assessment can be scored in a structured, consistent workflow, with the result and supporting context available for your team to review and act on — rather than a raw questionnaire to interpret. Scoring results can feed the vendor's security rating and composite vendor risk scoring.
Because the platform shares one data model, VeriSAQ results can feed vendor security ratings and composite vendor risk scoring, flow into risk-register decisions, and stay connected to evidence and audit history — without manual exports.
Yes. Alongside any tier, you can assign companion assessments that add focused depth in a specific dimension — covering AI systems and AI-related vendor risk, privacy and data governance, cloud and SaaS security, and operational resilience. Companions are assigned alongside Lite, Core, or Extended when that area is in scope; they add depth to a tier rather than replacing it.
Book a walkthrough and see third-party risk, compliance, and audit evidence on one platform.