Onboard vendors
The first step is getting a third party into SolveGRC as a vendor record and deciding how critical it is to you. There are two ways in: add a vendor directly, or route it through a governed intake request that someone approves.
Find the module
Open TPRM in the left sidebar. The executive dashboard is a good place to get your bearings (portfolio risk, top vendors), but you create vendors from Vendor Management.
Add a vendor directly
On Vendor Management, click Add Vendor to open Add New Vendor. Only Legal Name is required. The form also captures a display name, service category, website, industry, headquarters country, whether the vendor is publicly traded, a primary contact, and a next-review date. Status defaults to Prospective and Criticality Tier to Low. When you save, you see "Vendor created".
There is no CSV or bulk import. Your plan caps how many vendors you can have: Starter allows 25, Professional 100, and Enterprise has no limit.
The service category you choose matters: SolveGRC uses it to suggest a criticality tier, which you then confirm. Payment processing and Identity / SSO provider start at Critical. Until someone confirms a tier, the suggested tier replaces the one you picked in the form. Vendors at Medium or above also get a draft Supply-Chain Attestation assignment, due in 30 days.
Or route it through intake
For a governed onboarding process, use Intake Requests. Anyone with access can click New Request and file a request with the vendor's name and a business justification, plus context like the data classification, hosting model, and estimated spend. A reviewer then clicks Approve or Reject. Approving provisions a real vendor and links it back to the request; rejecting requires a reason. The requester cannot approve their own request.
Whether a vendor is added directly or provisioned from an approved intake request, it lands in the same Vendor Management inventory. Intake just adds a review-and-approve step in front of creation.
Set the vendor's criticality
Criticality is a business-impact judgment, kept separate from the external risk signals covered on the next page. SolveGRC suggests a tier from the service category and the data the vendor touches (PCI, PHI, PII, privileged access), with a plain-language rationale. To confirm it, use the Criticality Assessment card on the vendor's Overview: click Build profile, pick a tier under Confirm as, then click Save & confirm. The card's badge changes from Suggested to Confirmed, and SolveGRC logs who saved it.
Advance it through the lifecycle
Open a vendor and use the Lifecycle item in its sidebar to move it through your governed review stages, from intake and screening through onboarding, monitoring, reassessment, and eventually offboarding. Two guardrails apply on the way:
- A stage can require a checklist to be complete before you can advance.
- A transition marked Requires Approval needs a second reviewer. The person who requests it can never approve it.
A vendor's status ("active"), its criticality ("high"), and its lifecycle stage ("onboarding") are set independently and don't sync to each other. Use the lifecycle stage as the source of truth for where a vendor actually is in your process.
Fourth parties
Your vendors' own subprocessors and infrastructure providers ("fourth parties") live in a separate Fourth-Party Inventory, linked to vendors rather than onboarded through the vendor flow. Subprocessors that a vendor declares in its Supply-Chain Attestation appear under the label "Discovered — Awaiting Review" for you to Confirm or Reject.
With a vendor in the system, the next step is understanding its risk. Continue to Assess risk.