{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","download":{"releaseId":"sha256:0e1b87c81c6df3a7731724450a4addf288b73a1af31f910c346d83d2618b16a5","slug":"grc-vendor-risk-assessment-disposition","url":"/assets/agent_workflow-grc-vendor-risk-assessment-disposition-a7732220.427aac621b1e622d.json"},"kind":"record","record":{"attributes":{"department":"procurement","domain":"grc","lineOfDefense":"monitor"},"canonicalUrl":"https://workflow-library.com/all/?w=grc-vendor-risk-assessment-disposition","description":"Runs on one existing System with vendor=true. Uses the supplier record, contracts, assurance/CUECs, access and continuity evidence to produce a reviewed vendor risk assessment and authorized disposition for the business/risk owner and readiness evidence consumers. Two checkpoints retain expert challenge and the owner’s choice of conditions, treatment and monitoring; executor work is recorded in step results and documents, with no collection forms or runtime branches.","details":{"canonicalUrl":"https://workflow-library.com/all/?w=grc-vendor-risk-assessment-disposition","capabilities":[],"controls":["UC-TPRM-02","UC-TPRM-03","UC-TPRM-04","UC-ACCESS-21"],"domains":["grc"],"lineOfDefense":"monitor","mappingStatus":"mapped","releaseId":"sha256:0e1b87c81c6df3a7731724450a4addf288b73a1af31f910c346d83d2618b16a5","roleIntegrity":{"activityCount":0,"ermPhases":[],"lineRoles":[],"serviceModes":[],"warnings":[]},"sourceTemplateId":"workflow-library:grc-vendor-risk-assessment-disposition","standards":["iso-27001","nist-800-53","soc1","soc2"],"teams":["procurement","risk-management","it"]},"id":"wf:D56","mapUrl":"https://controlsmap.com/?v=1&node=wf%3AD56","slug":"grc-vendor-risk-assessment-disposition","sourceIds":["ccpa","gdpr","hipaa","iso-27001","nist-800-53","nist-csf-2","soc1","soc2"],"sourceUrl":null,"title":"Vendor Risk Assessment and Disposition","type":"workflow"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4213ed0177e7208cbd35e7e309550a359595b2a95e5998d6bb3dc452402bff28","properties":{},"sourceDetailPath":"/data/v1/records/wf-d56-387bb72b.json","sourceId":"wf:D56","targetDetailPath":"/data/v1/records/uc-uc-tprm-04-e6aef252.json","targetId":"uc:UC-TPRM-04","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6db868c65485ee877f1cfd1368a44f6b2f96275089bf0a76de3f35673acc94be","properties":{},"sourceDetailPath":"/data/v1/records/wf-d56-387bb72b.json","sourceId":"wf:D56","targetDetailPath":"/data/v1/records/uc-uc-tprm-03-c9edcf93.json","targetId":"uc:UC-TPRM-03","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bf4c143c58a1b72925f975d8166a806c340c17b07e1a326580e29b6ae1452329","properties":{},"sourceDetailPath":"/data/v1/records/wf-d56-387bb72b.json","sourceId":"wf:D56","targetDetailPath":"/data/v1/records/uc-uc-access-21-14f45683.json","targetId":"uc:UC-ACCESS-21","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:dabb39ba43e2253e43bf0e00f946794199ef0e0611046aa9b492b6d63d4372f0","properties":{},"sourceDetailPath":"/data/v1/records/wf-d56-387bb72b.json","sourceId":"wf:D56","targetDetailPath":"/data/v1/records/uc-uc-tprm-02-c35b26eb.json","targetId":"uc:UC-TPRM-02","type":"oversees"}],"schemaVersion":1}