What are vendor contacts?

This information is for superusers and all Isora GRC users who work with third-party vendor products.

Vendor contacts are people who know something about a particular third-party vendor product deployment. These people probably fall into one of three categories:

People who work at the vendor, such as a sales person or account manager.
Fourth-party consultants who contract with both the vendor and your institution.
Individuals within your institution who are involved with deploying the product, but do not have a user account in Isora GRC. (If they do have a user account, you would probably list them as an Owning user on the deployment, rather than a vendor contact.)

What is the purpose of vendor contacts?

Isora GRC provides a place for you to keep track of all of the relevant details about how your institution uses a particular third-party vendor product. Using vendor contacts makes it easier for you to figure out who to get in touch with when you need to find out more information, or, importantly, whom to send it to when you need to run a new assessment of a third-party vendor product.

Why are the contacts specific to the deployment, not the product or vendor?

Different units may deploy the same products for different purposes. It’s not necessarily the case that one contact at the vendor will be familiar with all of those deployments. In some cases, a single assessment of a product will suffice for multiple units using the product in similar ways. In other cases, the use case may require multiple assessments, which in turn, might need to be filled out by different people.