Glossary
The words we use.
Supplier assurance has its own vocabulary. This is what each term means in Vendwise.
- Active supplier
- A legal entity with an assessment under way, a decision in force or monitoring switched on. It counts once however many of its services you use. Archived suppliers keep their history but get no reminders or monitoring.
- Approve with conditions
- A decision to go ahead on the understanding that something specific is done by a date. Each condition becomes an action with an owner.
- Change event
- Something that may affect a decision, such as a supplier declaring a new hosting location. It creates a proposed review; a person decides whether it matters.
- Claim
- A statement about a control for a particular product, service or environment, backed by one or more evidence versions.
- Condition
- A requirement attached to a decision, with a due date. When it falls due, it creates follow-up work.
- Confidence
- How much the evidence can be relied on: how much of the questionnaire it covers, how old it is, whether its scope matches the service and whether anyone checked it. Shown separately from risk.
- Cyber Essentials
- A UK government-backed scheme covering basic technical controls. Cyber Essentials Plus adds a hands-on technical check by an assessor.
- Decision
- Approve, approve with conditions, reject or defer, recorded by a named person with their reasons and the exact evidence relied on. Decisions are never edited; amendments are new, linked records.
- Delegated access
- Access a client grants a consultancy to its workspace, with a role and an end date, which the client can revoke at any time.
- Engagement
- Your use of one specific service from a supplier. Decisions apply to an engagement and its use, never to a supplier universally.
- Enhanced review
- The deeper review needed when a service handles sensitive data, has privileged access or is a critical dependency.
- Evidence version
- One uploaded file, kept unchanged, with its fingerprint and dates. A new upload creates a new version rather than replacing the old one.
- Exception
- A recorded acceptance of a critical finding by someone with the authority to accept that risk. Without one, a critical finding blocks approval.
- Finding
- A gap between what a requirement asks for and what the evidence shows, with an owner and a severity.
- Fingerprint (SHA-256)
- A value calculated from a file’s contents. If the file changes, so does its fingerprint. It shows a file is unchanged, not that it is genuine.
- Inherent exposure
- How much a service could affect you before any safeguards: the data it handles, its access, how much you rely on it, how replaceable it is and where it operates.
- ISO/IEC 27001
- An international standard for an information security management system. A certificate applies to a stated scope, so the scope matters as much as the certificate.
- Policy version
- Your risk thresholds, review intervals and rules as they stood when a decision was made. Published versions never change, so past decisions can be reconstructed.
- Residual risk
- The risk left after safeguards, re-scored by a reviewer. Holding a certificate never lowers it automatically.
- SOC 2
- An independent auditor’s report on a service organisation’s controls. Type I looks at design at a point in time; Type II looks at how controls operated over a period.
- Template version
- A published questionnaire. Once used it never changes, so an assessment is always read against the questions actually asked.