From initial onboarding through procurement, security assessment, continuous monitoring, and annual reviews — every phase is tracked, automated, and audited.
A structured workflow ensures no vendor slips through the cracks.
Structured intake form captures vendor metadata, data security questions, and FAIR analysis inputs. Autosave via AJAX prevents data loss. Stakeholders are assigned as owners, reviewers, or observers.
Template-driven questionnaires are sent to vendors via secure UUID links — no account required. ISO 27001 and Tier 2 templates included out of the box. All file uploads are encrypted at rest.
Risk analysts run the FAIR calculator to produce ALE figures. Assessment submission auto-creates a draft FAIR analysis, pre-populating data from the vendor's security responses.
Once approved, vendors enter tier-based SRS monitoring. UpGuard and Shodan scores are tracked over time. Score drops and overdue rescores surface in the Cyber Todo dashboard.
Reviews are scheduled one year from vendor approval. Email reminders fire at 30 days, on due date, and every 7 days when overdue. Stakeholders complete a structured review form.
The Cyber Todo dashboard aggregates action items: expiring certificates, overdue rescores, score drops, unapproved vendors, and custom tasks into one prioritized view.
The onboarding form is the entry point for every vendor relationship. It captures everything needed to assess risk, assign responsibility, and begin the security evaluation process.
Vendors complete security assessments through public-facing forms accessed via unique UUID links. No vendor account is needed, reducing friction while maintaining security through CSRF protection and encrypted file storage.
Fair TPRM ensures vendor relationships are re-evaluated on schedule. Reviews are automatically due one year from approval, with a three-tier email reminder system that prevents anything from falling through the cracks.
Every feature is built with security-first design principles.
Enterprise IdP support for Okta, Microsoft Entra ID, and other SAML providers. Group mapping syncs IdP groups to local ACL roles automatically on login.
RFC 6238 time-based one-time passwords compatible with Google Authenticator and Authy. QR code enrollment makes setup simple for end users.
Every action is logged with user ID, action type, affected record, old/new values, IP address, and user agent. Full accountability for compliance audits.
Super admins can "View As" another user for troubleshooting. Original session is preserved, amber banner is displayed, and all actions are audit logged.
Get running in minutes with Docker or traditional installation.
Fair TPRM ships with a Docker Compose stack for instant deployment, or can be installed on any Apache + PHP 8.3 server. The 6-step setup wizard handles all configuration without touching code.
Fair TPRM brings data-driven vendor risk management to organizations of every size.