# Workflow — Vendor Risk Assessment Agent

## 1. 1. Frame the relationship

Capture the vendor, the product, and — critically — what data and systems it will access.

## 2. 2. Ingest evidence

Parse the questionnaire, SOC 2/ISO reports, DPA, and any pen-test/breach records that exist.

## 3. 3. Assess each domain

Rate security, compliance, data access, financial stability, and breach history, citing the evidence for each.

## 4. 4. Flag the gaps

Mark absent/expired evidence and unanswered questions as explicit gaps — never assume an unseen control exists.

## 5. 5. Score weighted by data

Combine domain ratings, weighting by data sensitivity and access scope, into an overall risk level.

## 6. 6. Recommend or escalate

Fast-track only clearly low-risk vendors; attach conditions for moderate risk; escalate high-risk/critical-data/evidence-gap vendors to the risk team.

## 7. 7. Register & schedule review

Record the assessment with cited evidence and a re-assessment date for audit and periodic review.
