{"catalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","download":{"releaseId":"sha256:adcfcb6fff7f44b4a8c9a15a93ccac2186d3c5dc9a53dba8c0d1fd7ad75c05f2","slug":"grc-vendor-risk-assessment-disposition","url":"/controls/assets/agent_workflow-grc-vendor-risk-assessment-disposition-a7732220.ef7b9fc6ce5beac9.json"},"kind":"record","record":{"attributes":{"department":"procurement","domain":"grc","lineOfDefense":"monitor"},"canonicalUrl":"https://assureswarm.com/workflows/all/?w=grc-vendor-risk-assessment-disposition","description":"Runs on one existing System with vendor=true. Uses the supplier record, contracts, assurance/CUECs, access and continuity evidence to produce a reviewed vendor risk assessment and authorized disposition for the business/risk owner and readiness evidence consumers. Two checkpoints retain expert challenge and the owner’s choice of conditions, treatment and monitoring; executor work is recorded in step results and documents, with no collection forms or runtime branches.","details":{"canonicalUrl":"https://assureswarm.com/workflows/all/?w=grc-vendor-risk-assessment-disposition","capabilities":[],"controls":["UC-TPRM-02","UC-TPRM-03","UC-TPRM-04","UC-ACCESS-21"],"domains":["grc"],"lineOfDefense":"monitor","mappingStatus":"mapped","releaseId":"sha256:adcfcb6fff7f44b4a8c9a15a93ccac2186d3c5dc9a53dba8c0d1fd7ad75c05f2","roleIntegrity":{"activityCount":0,"ermPhases":[],"lineRoles":[],"serviceModes":[],"warnings":[]},"sourceTemplateId":"workflow-library:grc-vendor-risk-assessment-disposition","standards":["iso-27001","nist-800-53","soc1","soc2"],"teams":["procurement","risk-management","it"]},"id":"wf:D56","mapUrl":"https://assureswarm.com/controls/?v=1&node=wf%3AD56","slug":"grc-vendor-risk-assessment-disposition","sourceIds":["ccpa","gdpr","hipaa","iso-27001","nist-800-53","nist-csf-2","soc1","soc2"],"sourceUrl":null,"title":"Vendor Risk Assessment and Disposition","type":"workflow"},"relationships":[{"expectedCatalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","id":"rel:4213ed0177e7208cbd35e7e309550a359595b2a95e5998d6bb3dc452402bff28","properties":{},"sourceDetailPath":"/controls/data/v1/records/wf-d56-387bb72b.json","sourceId":"wf:D56","targetDetailPath":"/controls/data/v1/records/uc-uc-tprm-04-e6aef252.json","targetId":"uc:UC-TPRM-04","type":"oversees"},{"expectedCatalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","id":"rel:6db868c65485ee877f1cfd1368a44f6b2f96275089bf0a76de3f35673acc94be","properties":{},"sourceDetailPath":"/controls/data/v1/records/wf-d56-387bb72b.json","sourceId":"wf:D56","targetDetailPath":"/controls/data/v1/records/uc-uc-tprm-03-c9edcf93.json","targetId":"uc:UC-TPRM-03","type":"oversees"},{"expectedCatalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","id":"rel:bf4c143c58a1b72925f975d8166a806c340c17b07e1a326580e29b6ae1452329","properties":{},"sourceDetailPath":"/controls/data/v1/records/wf-d56-387bb72b.json","sourceId":"wf:D56","targetDetailPath":"/controls/data/v1/records/uc-uc-access-21-14f45683.json","targetId":"uc:UC-ACCESS-21","type":"oversees"},{"expectedCatalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","id":"rel:dabb39ba43e2253e43bf0e00f946794199ef0e0611046aa9b492b6d63d4372f0","properties":{},"sourceDetailPath":"/controls/data/v1/records/wf-d56-387bb72b.json","sourceId":"wf:D56","targetDetailPath":"/controls/data/v1/records/uc-uc-tprm-02-c35b26eb.json","targetId":"uc:UC-TPRM-02","type":"oversees"}],"schemaVersion":1}