Vendor Security Assessments: Every Vendor Re-Measured When the Policy Changes

Security reports age every day, and the limits do not hold still

Each vendor in scope sends a security package: a SOC report, a bridge letter when the report period ended a while ago, a penetration test summary and a completed questionnaire. The packages sit in Box, one folder per vendor. The assessment policy in Google Drive sets how old a report may be for each vendor tier. Attio holds the vendor record with its tier, business owner and annual spend, and spend sets the order reviews happen in.

The first pass is manageable. The trouble starts when something moves. Security shortens the age limit for critical vendors, and someone re-checks only the vendors whose status flips, missing the ones that stay blocked for the same reason but now sit further over the limit. Spend is copied from last year's export instead of Attio, and a large vendor lands in the last batch. A vendor is reclassified, and nobody re-confirms the order of everything already blocked.

Who works in the room

Nova is the default agent, so a plain question about a vendor's status lands with it, while the notice list and every revision belong to Ryan. Nova reads Box and Attio under a lasting grant from the risk lead, and takes annual spend from the Attio record only, even when an email quotes another figure. After a re-measure, Nova mentions Ryan with the changed vendors and Ryan leads the thread. Ryan's vendor notices are drafted in the risk lead's own Outlook.

From first read to four closeout records

The policy and the age-limit table are linked from the room guidelines, so both agents apply the same version. Every result names the report and the date it was measured from.

A tighter limit, then a reclassified vendor

A tighter age limit changes more vendors than it seems to. A critical vendor that was blocked at 40 days over the old limit is now 130 days over the new one, and its reason has not changed. Nova still records it as revised, because the reviewer's batch and the business owner's notice both carry that number. Ryan then lists every revised vendor with its old and new figures side by side, so the risk lead can approve the changes in one pass.

Reclassification is the quieter change. When a standard vendor starts handling customer data and moves to critical, its own limit tightens and its place among the blocked vendors can shift. Ryan re-confirms every blocked vendor in batch order rather than only the one that moved, and posts the list with each position marked unchanged or moved. Nothing reaches Attio until the risk lead approves it.

What the checks catch

• A vendor that stays blocked for a stale report but whose days over the limit changed under the new table, which still counts as a revision
• Annual spend taken from an old export or an email instead of the Attio record, which puts a vendor in the wrong review batch
• A bridge letter or newer report filed in another vendor's Box folder, so the first read missed it
• A notice list that still names a vendor cleared since its new report arrived, or leaves out one that became blocked
• A reclassified vendor that shifts the order of the blocked list, caught by re-confirming every blocked vendor in sequence

What stays with people

• Approving every disposition before the vendor record in Attio changes
• Deciding whether an open penetration test finding blocks a vendor or becomes a condition
• Sending each vendor notice from Outlook, which Ryan prepares as a draft
• Signing the closeout record for each tier

Integrations in this workflow

Kylon is not a third-party risk platform and does not take the place of one. The vendor book stays in Attio and the evidence stays in Box. The room is where the measuring, checking and approving happen, in order.

• Attio
• Box
• Google Drive
• Outlook
• Slack

• Attio holds each vendor's record, tier, business owner and annual spend, and receives every approved disposition
• Box holds the security packages: SOC reports, bridge letters, penetration test summaries and questionnaires
• Google Drive keeps the assessment policy, the age-limit table and the draft notice list
• Outlook is where vendors send updated reports, and where notices go out once a person sends the draft
• Slack is where business owners ask when their vendor will clear, and Ryan collects those questions in the assessment thread

Where to start

Pick one assessment cycle. Give the room the Box vendor folders, connect Attio with a grant the risk lead approves, and add one line to the room guidelines: when a limit or a tier changes, every vendor is re-measured, and nothing reaches Attio until the risk lead approves the revised list.

“When the limit changed, every vendor was re-measured, including the ones whose status stayed the same.”

Set it up with your agent

Open a new Room, add your agent and paste this prompt. It connects the tools, builds the App with you and asks for your rules one step at a time, and nothing goes out until a person approves it.