Financial Services · Managed platform (BitSight)

Third-Party Risk Scoring

Continuous outside-in monitoring of your vendors' security, run as part of your third-party risk program

Book a demonstrationRequest a technical briefingFactsheet

Overview

What you are buying

Moraph resells, implements and runs BitSight to monitor the security posture of your vendors and other third parties between assessments. BitSight rates each organization from externally observable evidence and alerts when a rating or finding changes; Moraph sets up your vendor portfolio, triages the alerts, follows up material findings with the relationship owner, and reports on the portfolio. Your third-party risk team decides what a finding means for the relationship.

The problem it solves

Most third-party risk programs assess vendors through questionnaires and document reviews at onboarding and then once a year or less. Between reviews, a vendor can expose a vulnerable service, show signs of compromised machines or suffer a breach, and the institution hears about it from the news or not at all. Teams that buy security ratings often find they lack the people to watch the alerts, check whether a finding is real, and chase it with the vendor, so the subscription becomes a dashboard nobody acts on.

  • Vendor security is assessed periodically, leaving long gaps between reviews
  • Breaches and exposures at vendors are learned about late
  • Rating alerts arrive faster than the team can check and follow them up
  • Examiners expect ongoing monitoring proportionate to each vendor's criticality

Who uses it

  • Third-party and vendor risk management teams at banks, credit unions, broker-dealers and insurers
  • Chief information security officers and security teams who assess vendor security
  • Business owners of critical vendor relationships
  • Procurement and contract teams who need risk input at onboarding and renewal
  • Risk committees, internal audit and examiners

Requirements it supports

Interagency Guidance on Third-Party Relationships: Risk Management (2023)FFIEC IT Examination Handbook (Outsourcing Technology Services and Information Security booklets)NYDFS Cybersecurity Regulation 23 NYCRR 500.11 (third-party service provider security policy)Interagency Guidelines Establishing Information Security Standards (GLBA Section 501(b))SEC Regulation S-P (as amended in 2024, service provider oversight)PRA Supervisory Statement SS2/21 (outsourcing and third party risk management)

The product supports these requirements; meeting them remains your organization’s responsibility.

Responsibilities

Who is responsible for what

BitSight provides the ratings and findings, Moraph runs the platform and the monitoring work, and your organization decides what the results mean for each vendor relationship.

AreaMoraphBitSightYour organization
LicensingResells BitSight subscriptions and tracks portfolio size and renewalsSets subscription terms and provides the serviceAgrees the subscription scope and accepts BitSight's terms
Platform availabilityReports service issues and coordinates with BitSightProvides the platform under its own service commitmentsProvides network access for users to the service
Ratings and findingsChecks findings and requests corrections where attribution looks wrongProduces ratings and findings and handles correctionsUses ratings as one input to its own risk assessments
Portfolio setupLoads vendors, matches records and applies tiersMaintains the organization records vendors are matched toProvides the vendor list and criticality, and approves tiers
Identity and accessApplies approved roles and prepares access reviewsProvides the platform's access controlsApproves access and runs your identity provider
Alert monitoringTriages alerts and records the classificationGenerates alerts on rating and finding changesApproves alert thresholds
Finding follow-upPrepares summaries and tracks follow-up to an outcomeShows the evidence behind findingsContacts vendors, decides on escalation and accepts risk
Incident responseTells you about significant vendor events seen in BitSight and supports your responsePublishes breach and event information it detectsRuns your own incident and vendor incident processes
ChangesApplies approved portfolio, tier and threshold changesPublishes changes to its rating methods and featuresApproves changes
User supportSupports your users with the platform and reportsSupports Moraph on product and rating questionsNames relationship owners and makes them available

See how it works

A short walkthrough

Illustrative screens of how Moraph runs the service, with fictional sample data. They are not screens of BitSight itself, which belongs to its vendor.

  1. Step 1

    Onboarding the vendor portfolio

    During implementation, each group of vendors is tracked from loading to matched, tiered and monitored.

    Vendor groupVendorsMatchedTieredThresholds approvedStatus
    Critical technology providers343434YesMonitoring
    Payments and card processing121111Yes1 match unconfirmed
    Professional services888080PendingIn progress
    Facilities and logistics57410NoMatching
    Prospective vendors66n/an/aPre-contract ratings
    During implementation, each group of vendors is tracked from loading to matched, tiered and monitored.

  2. Step 2

    Configuration baseline review

    Tiers, thresholds and contact rules are written down and reviewed with your TPRM manager.

    Baseline v2 · Example Credit Union (fictional)

    Tiers
    Critical, high, moderate, low
    Critical tier alert threshold
    Set by your TPRM manager
    Vendors monitored
    191
    Vendor contact channel
    Relationship owner
    Risk acceptance authority
    As set in your TPRM policy
    Last checked against live
    Fictional sample date

    Differences found

    • !Two vendors terminated in your system still monitored
    • One new critical vendor not yet added
    • No difference in thresholds
    Tiers, thresholds and contact rules are written down and reviewed with your TPRM manager.

  3. Step 3

    Alert triage

    Moraph's team reviews each alert and classes it before anything goes to your relationship owners.

    AlertVendorTierChangeClassificationStatus
    BA-4410Vendor 2087CriticalNew compromised-system findingEscalateSummary sent
    BA-4406Vendor 1132HighRating drop past thresholdFollow-upWith owner
    BA-4401Vendor 3390ModerateExposed service findingAttribution checkQuerying BitSight
    BA-4397Vendor 0815LowRating dropInformationalClosed
    BA-4392Vendor 2264HighPublic breach disclosureEscalateWith security
    Moraph's team reviews each alert and classes it before anything goes to your relationship owners.

  4. Step 4

    Following up a finding

    A material finding is tracked from Moraph's summary through the vendor's response to a recorded outcome.

    FU-0718 · Vendor 2087 (fictional), critical tier

    1. Compromised-system finding confirmed and summarizedMoraph service team
    2. Technical assessment addedSecurity analyst
    3. Summary taken to vendorRelationship owner
    4. Vendor response and remediation plan recordedRelationship owner
    5. Finding no longer observed in BitSightMoraph service team
    6. Follow-up closedTPRM manager
    A material finding is tracked from Moraph's summary through the vendor's response to a recorded outcome.

  5. Step 5

    A change request

    Adding a vendor or changing a tier goes through a request the TPRM manager approves.

    CR-0533 · Add Vendor 3518 (fictional) to monitoring

    Requested by
    Procurement
    Reason
    Contract signed, critical service
    Proposed tier
    Critical
    Relationship owner
    Owner 0461
    Pre-contract rating
    On file
    Approval
    TPRM manager

    Before monitoring starts

    • Match to BitSight organization record confirmed
    • Critical tier thresholds applied
    • Owner briefed on finding summaries
    Adding a vendor or changing a tier goes through a request the TPRM manager approves.

  6. Step 6

    Monthly service review

    Each month Moraph reviews portfolio changes, significant findings and open follow-ups with your TPRM manager.

    Monthly service review · Example Credit Union (fictional)

    Vendors monitored
    191
    Alerts received
    42
    Escalated
    3
    Follow-ups open
    7
    Risk acceptances
    1 new
    Attribution corrections
    2 requested

    Actions agreed

    • !Two follow-ups past your policy's review point
    • Remove terminated vendors from monitoring
    • Review thresholds for professional services tier
    Each month Moraph reviews portfolio changes, significant findings and open follow-ups with your TPRM manager.

Workflows

The principal workflows

  1. Build the portfolio

    Your vendor list is loaded into BitSight and each vendor is matched to the right organization and tiered by criticality, so monitoring effort follows risk.

    • Vendor list exported from your vendor management system
    • Moraph matches each vendor to its BitSight organization record
    • Uncertain matches confirmed with the relationship owner
    • Vendors tiered using the criticality from your program
    • Alert thresholds set for each tier and approved by your TPRM manager

  2. Monitor

    BitSight updates ratings and findings continuously from externally observable evidence. Moraph's operations team receives the alerts and triages them against the vendor's tier and history.

    • BitSight raises alerts on rating drops and new findings
    • Moraph reviews the finding and the evidence behind it
    • Findings that appear to be misattributed are checked with the vendor or BitSight
    • Alert classed as informational, follow-up or escalation
    • Outcome recorded on the vendor's monitoring record

  3. Follow up

    For findings that need action, Moraph prepares a summary for the relationship owner and supports the conversation with the vendor, keeping a record until the finding is resolved or the risk accepted.

    • Finding summary sent to the relationship owner and TPRM manager
    • Vendor contacted through your agreed channel
    • Vendor response and remediation plan recorded
    • Resolution confirmed in BitSight where the evidence allows
    • Unresolved findings escalated or the risk formally accepted by your organization

  4. Report

    Ratings and findings feed your vendor risk assessments, onboarding and renewal decisions, and committee reporting.

    • Rating and findings attached to the vendor's periodic assessment
    • Prospective vendors rated before contract
    • Portfolio report prepared for the risk committee
    • Monthly service review held with your TPRM manager
    • Evidence of monitoring kept for audit and examiners

Roles and permissions

Who does what in the product

Each role below is a starting point. During implementation we set them up to match your teams, and every action anyone takes is recorded in the audit trail.

TPRM manager

Head of third-party risk, vendor risk manager, vendor management office lead

Owns the third-party risk program and decides how monitoring results affect each relationship.

Sees

  • The whole vendor portfolio, ratings, findings and tiers
  • Alerts and Moraph's triage decisions
  • Open follow-ups, escalations and risk acceptances
  • Service reports and the monitoring record

Does

  • Approves vendor tiers and alert thresholds
  • Decides on escalated findings
  • Accepts risk, or asks for it to be accepted at the right level, when a finding is not resolved
  • Approves vendors added to or removed from monitoring
  • Reports to risk committees
  • Attends the monthly service review

Cannot

  • Edit or delete the monitoring record
  • Change BitSight's ratings or findings
  • Accept risk above the authority your policy gives them
Approvals
Approves tiers, thresholds, portfolio changes and risk acceptance within their authority.
Notified about
Escalated findings, follow-ups overdue under your policy, and rating changes on critical vendors.

Relationship owner

Business relationship owner, vendor manager, service owner

Owns the relationship with a vendor and is accountable for following findings up with it.

Sees

  • Ratings, findings and history for their own vendors
  • Finding summaries prepared by Moraph
  • Open follow-ups for their vendors

Does

  • Takes finding summaries to the vendor through the agreed channel
  • Records the vendor's response and remediation plan
  • Confirms uncertain vendor matches
  • Requests escalation or risk acceptance

Cannot

  • See vendors they do not own unless granted
  • Close a follow-up without a recorded outcome
  • Change tiers or thresholds
Approvals
Closures and risk acceptance on their vendors are approved by the TPRM manager.
Notified about
New finding summaries on their vendors and follow-ups coming due.

Security analyst

Information security analyst, third-party security assessor, CISO office

Judges the technical significance of findings and advises the TPRM manager and relationship owners.

Sees

  • Findings and the evidence behind them for all monitored vendors
  • Moraph's triage notes
  • Vendor remediation responses

Does

  • Reviews escalated findings and adds a technical assessment
  • Advises whether a vendor's response is adequate
  • Suggests changes to alert thresholds

Cannot

  • Approve tiers, thresholds or risk acceptance
  • Contact vendors directly unless your process allows
  • Change BitSight's ratings or findings
Approvals
Their assessments go to the TPRM manager for decision.
Notified about
Findings escalated for technical review.

Procurement

Procurement manager, sourcing lead, contract manager

Brings security posture into vendor selection, contracting and renewal.

Sees

  • Ratings for prospective vendors they requested
  • Ratings and open findings for vendors at renewal

Does

  • Requests a rating for a prospective vendor
  • Attaches the rating to the sourcing file
  • Flags renewals that need a security review

Cannot

  • See detailed findings unless granted
  • Add vendors to continuous monitoring without TPRM approval
  • Change tiers or thresholds
Approvals
Adding a vendor to continuous monitoring is approved by the TPRM manager.
Notified about
Ratings completed for their requests.

Moraph service team

Moraph managed service analyst, Moraph service delivery manager

Runs BitSight and the routine monitoring work on your behalf.

Sees

  • The portfolio, ratings, findings and alerts
  • Follow-up status and the monitoring record
  • BitSight administrative settings

Does

  • Loads and maintains the vendor portfolio and matches vendors to BitSight records
  • Triages alerts and records the classification
  • Prepares finding summaries for relationship owners
  • Checks and requests corrections to misattributed findings
  • Prepares portfolio reports and runs the monthly service review
  • Raises cases with BitSight support and tracks them

Cannot

  • Accept risk or decide what a finding means for the relationship
  • Change tiers or thresholds without approval
  • Contact your vendors except through the channel you agree
Approvals
Portfolio, tier and threshold changes follow requests approved by the TPRM manager.
Notified about
All BitSight alerts on the portfolio, and BitSight advisories.

Auditor or examiner (read-only)

Internal auditor, external auditor, regulatory examiner (under temporary access)

Checks that vendors are monitored in proportion to their risk and that findings are followed up.

Sees

  • The portfolio, tiers and thresholds within scope
  • Alerts, triage decisions, follow-ups and risk acceptances
  • Portfolio reports and the monitoring record

Does

  • Selects vendors and alerts for testing
  • Reviews the evidence of follow-up
  • Exports reports within scope, with each export logged

Cannot

  • Change, approve or close anything
  • See vendors outside the scope granted
  • Keep access after it expires
Approvals
Their access is approved by the TPRM manager, with a scope and an end date.
Notified about
Nothing by default; access granted and expiring is confirmed to the person who approved it.

Permissions at a glance

ActionTPRM managerRel. ownerSecurityProcurementMoraph teamAuditor
View portfolio ratingsFullOwn work onlyView onlyOwn work onlyView onlyView only
View detailed findingsFullOwn work onlyView onlyNo accessView onlyView only
Add or remove monitored vendorsApprovesNo accessNo accessOwn work onlyFullNo access
Set tiers and alert thresholdsApprovesNo accessView onlyNo accessFullView only
Triage alertsView onlyNo accessNo accessNo accessFullView only
Prepare finding summariesView onlyView onlyView onlyNo accessFullView only
Record vendor responsesFullOwn work onlyView onlyNo accessView onlyView only
Add technical assessmentView onlyView onlyFullNo accessNo accessView only
Accept risk on a findingApprovesNo accessNo accessNo accessNo accessView only
Request pre-contract ratingsFullOwn work onlyNo accessOwn work onlyFullNo access
View monitoring recordView onlyOwn work onlyView onlyNo accessView onlyView only
Manage users and rolesApprovesNo accessNo accessNo accessOwn work onlyNo access
  • Full
  • Own work only
  • Approves
  • View only
  • No access

How access is controlled

  • Moraph triages and prepares, your people decide: classification of an alert is Moraph's work, but escalation outcomes, closures and risk acceptance are your organization's decisions.
  • Relationship owners and procurement see only their own vendors unless your TPRM manager grants more.
  • Contact with vendors follows the channel you agree during implementation, usually through the relationship owner, so vendors hear from you rather than from a third party.
  • Access reviews list each person's role for certification by the TPRM manager, and auditors get temporary read-only access with a scope and an end date.

Features

What it does

Security ratings

BitSight rates each monitored organization from externally observable evidence, so you can compare vendors and follow changes over time.

Risk vector findings

BitSight shows the findings behind a rating, such as signs of compromised systems, exposed services, patching and configuration issues, and public breach disclosures.

Portfolio monitoring

All monitored vendors in one view, grouped by tier, business line or relationship owner.

Tier-based alert thresholds

Alert thresholds are set by vendor tier, so critical vendors raise alerts on smaller changes.

Managed alert triage

Moraph's operations team reviews each alert, checks the evidence and classes it before anything reaches your relationship owners.

Attribution checks

Findings that may belong to the wrong organization or to shared infrastructure are checked before they are acted on, and corrections are requested from BitSight where needed.

Finding follow-up

Material findings are summarized for the relationship owner and tracked through the vendor's response to resolution or risk acceptance.

Pre-contract rating

Prospective vendors are rated before contract, so procurement and the TPRM team see security posture alongside other due diligence.

Vendor management integration

Ratings, tiers and open findings are shared with your vendor management system, including Moraph's Vendor Risk Management (VRM).

Monitoring record

Every alert, triage decision, follow-up and outcome is recorded against the vendor, as evidence of ongoing monitoring.

Portfolio reporting

Rating distribution, changes, open findings and follow-up status by tier, for the TPRM manager and risk committees.

Monthly service review

A regular review of portfolio changes, significant findings, open follow-ups and service matters with your TPRM manager.

Integrations

How it connects to your systems

Connects toHowWhat flows
Vendor management systemYour vendor inventory and criticality come from your vendor management system, including Moraph's Vendor Risk Management (VRM), and ratings and open findings go back to it.In: vendors, criticality and owners. Out: ratings, tiers and open findings.
Procurement and sourcingRequests for pre-contract ratings come from your sourcing process, and results are attached to the sourcing file.In: prospective vendor details. Out: ratings and summary findings.
GRC platformRatings and follow-up status can be shared with your governance, risk and compliance tool for enterprise risk reporting.Out: ratings, open findings and follow-up status.
Security operationsSignificant vendor events can be passed to your security team's case or ticketing tools.Out: escalated findings and vendor events.
Single sign-onUsers sign in through your identity provider (SAML or OpenID Connect) where supported by BitSight.In: user identity and group membership.
Moraph service portalAlerts, triage decisions, follow-ups and service reports are tracked in Moraph's service portal and available through the Moraph Work API.Out: tickets, alerts, follow-ups and service reports.

Each integration is confirmed in discovery and specified in the design. See how an engagement progresses.

Security and privacy

How your data is protected

Single sign-on

Your staff and Moraph's analysts sign in through identity providers with multi-factor authentication, so your access policies apply.

Role-based access

Relationship owners see their own vendors; administering the platform is separate from deciding on findings.

Confidential vendor information

Your vendor list, tiers and follow-up records are your confidential information and are shared only with the people and systems you approve.

Encryption and keys

Data in Moraph's service portal is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Alerts, triage decisions, follow-ups, risk acceptances and changes are logged with the person and time.

Data residency

Moraph's service portal runs in the United States, United Kingdom or Australia region you choose; BitSight's hosting follows its own terms.

Company-wide controls, independent audits (SOC 2 Type II and ISO/IEC 27001) and data residency are described in our Trust Center, where you can request the evidence pack.

Reporting

What you can report on

10 standard reports, grouped by who uses them. Each shows who it is for, how it can be broken down, how it is delivered and what it is used for. The data behind them is also available to your own reporting tools.

Portfolio

Portfolio ratings

For tPRM manager and risk committees

Every monitored vendor with its tier, current rating and change since the last period.

Break down by
Tier, Business line, Relationship owner, Rating band
Delivered as
Live view; PDF and CSV export
Used for
Seeing where security posture is weakest among the vendors that matter most.

Rating changes

For tPRM manager and security

Vendors whose rating moved past their tier's threshold in the period, with the findings behind the move.

Break down by
Tier, Direction, Risk vector, Period
Delivered as
Live dashboard; scheduled email
Used for
Spotting deterioration between periodic assessments.

Pre-contract ratings

For procurement and TPRM manager

Ratings requested for prospective vendors, with summary findings and the outcome of the sourcing decision.

Break down by
Requester, Business line, Rating band, Status
Delivered as
Live view; CSV export
Used for
Bringing security posture into vendor selection.

Monitoring and follow-up

Alert triage

For tPRM manager and Moraph

Alerts received, how each was classed, and the evidence and reasoning recorded.

Break down by
Tier, Alert type, Classification, Period
Delivered as
Live dashboard; CSV export
Used for
Showing every alert was looked at and how it was judged.

Open follow-ups

For tPRM manager and relationship owners

Findings under follow-up with the vendor, the vendor's response, the owner and the age of each.

Break down by
Relationship owner, Tier, Age band, Status
Delivered as
Live view; scheduled email
Used for
Making sure findings are chased to resolution.

Risk acceptances

For tPRM manager, risk committees, audit

Findings where risk was accepted rather than resolved, who accepted it and any review date set.

Break down by
Tier, Approver, Review date
Delivered as
Live view; PDF export
Used for
Keeping accepted risks visible and reviewed.

Attribution corrections

For tPRM manager and Moraph

Findings checked for misattribution, corrections requested from BitSight and their outcome.

Break down by
Vendor, Status, Period
Delivered as
Live view; CSV export
Used for
Avoiding action on findings that do not belong to the vendor.

Governance and audit

Program summary

For risk committees and senior management

Portfolio coverage by tier, rating distribution, significant events, open follow-ups and risk acceptances in the period.

Break down by
Period, Tier, Business line
Delivered as
PDF; scheduled email
Used for
Committee oversight of third-party security risk.

Vendor monitoring history

For auditors, examiners and the TPRM manager

For a selected vendor and period, its ratings, alerts, triage decisions, follow-ups and outcomes.

Break down by
Vendor, Date range
Delivered as
On request; PDF and CSV export
Used for
Evidencing ongoing monitoring for a specific relationship.

Monthly service review pack

For tPRM manager

Portfolio changes, significant findings, open follow-ups, service issues and planned changes for the period.

Break down by
Period, Topic
Delivered as
PDF
Used for
Overseeing Moraph's service and agreeing actions.

Exports, access and evidence

  • Ratings and findings come from BitSight; triage, follow-up and service reports come from Moraph's service record.
  • Reports can be exported to CSV, and summary and evidence reports to PDF, and scheduled to arrive by email for the people entitled to see them.
  • Reports respect each viewer's role: relationship owners see their own vendors, the TPRM manager sees the whole portfolio, and auditors get read-only access within their scope.
  • Ratings, tiers and follow-up status can be sent to your vendor management system or data warehouse, and tickets and service reports are available through the Moraph Work API.
  • Monitoring histories can be produced for a past period and give the same result each time, and running and exporting a report is itself recorded.

Deployment

Where and how it runs

BitSight service, run by Moraph

BitSight's hosted service, subscribed through Moraph, with Moraph's team operating the portfolio and monitoring work.

Co-managed

Your team keeps some of the work, such as vendor follow-up, and Moraph runs portfolio maintenance, alert triage and reporting.

With Vendor Risk Management

Run alongside Moraph's Vendor Risk Management (VRM), so ratings and findings sit with the rest of each vendor's due-diligence record.

Security controls, independent audits and data residency are set out in our Trust Center. Engagement models and what drives a quotation are on Working with Moraph.

Implementation

What a rollout involves

The general phases are on Working with Moraph. For this product, they involve the following.

Program alignment

We review your third-party risk policy and tiering with your TPRM manager and agree how ratings will be used, who receives findings and how vendors are contacted.

Portfolio load

Your vendor list is loaded and each vendor matched to its BitSight organization record. We need an export from your vendor management system and help from relationship owners on uncertain matches.

Tiers and thresholds

Vendors are tiered from your existing criticality ratings, and alert thresholds are set for each tier for your TPRM manager to approve.

Baseline review

Current ratings and open findings across the portfolio are reviewed, and the findings that need follow-up are agreed with you.

Integration and access

Single sign-on, roles and the link to your vendor management system are set up, and relationship owners are trained on what they will receive.

Handover to service

Alert triage, follow-up tracking, reporting and the monthly service review start under Moraph's managed service.

Limitations

What it does not do

Worth knowing before you evaluate it.

  • Moraph is not the vendor. BitSight owns the platform and its rating methods, and BitSight's own service commitments, roadmap and outages apply.
  • Subscriptions are subject to BitSight's terms, which you accept as part of the agreement.
  • Ratings are based on what can be observed from outside an organization. They do not replace questionnaires, document review, contract terms or on-site assessment.
  • Findings can be misattributed, for example on shared hosting or recently changed networks. Moraph checks findings before follow-up, but some will need confirmation with the vendor.
  • A good rating does not mean a vendor is secure, and a poor rating does not on its own mean a vendor should be dropped. Those judgments are your organization's.
  • Moraph does not contact your vendors except through the channel you agree, and does not negotiate with them on your behalf.
  • Moraph does not change BitSight ratings; corrections are requested from BitSight under its own process.
  • Fourth parties and vendors outside your subscription are not monitored unless they are added to the portfolio.

Evaluation checklist

What to test in a demonstration or pilot

Questions worth putting to us, and to any other vendor you are considering.

  1. Share a sample of your critical vendors and review their ratings and findings with Moraph
  2. Ask how a recent alert on one of them would be triaged and summarized
  3. Agree draft tiers and thresholds and see how many alerts they would have produced
  4. Walk through a follow-up from finding to recorded outcome
  5. Check the responsibilities table against your own operating model
  6. Review a sample vendor monitoring history against what your examiners ask for

Questions

Frequently asked questions

Does a security rating replace our vendor assessments?

No. Ratings show what can be observed from outside a vendor, between your assessments. They are one input alongside questionnaires, document review and contract terms.

Will Moraph contact our vendors?

Only through the channel you agree. Usually Moraph prepares the finding summary and your relationship owner takes it to the vendor.

We already subscribe to BitSight. Can Moraph run it?

Yes. We review your portfolio, tiers and thresholds, agree a baseline with you, and take over triage, follow-up tracking and reporting. The subscription can stay with you or move to Moraph, depending on your agreement with BitSight.

How is it priced?

BitSight subscriptions are priced under BitSight's terms, usually by the number of vendors monitored, and Moraph's implementation and managed service are quoted separately. See Working with Moraph for what drives a quotation.

What if a vendor disputes a finding?

Moraph checks the evidence and, where the finding looks wrong, requests a correction from BitSight under its process and records the outcome.

Is there an accessibility conformance report?

Ask for one through the procurement request form at /how-to-buy/request, naming the service you are evaluating.

Next steps

Evaluate Third-Party Risk Scoring

Book a demonstration

See the product working with sample data, focused on your workflows.

Request a demonstration

Request a technical briefing

Architecture, integrations, security and hosting, with our engineers and your technical team.

Request a briefing

Factsheet

This page on two sides, to share with colleagues or add to your evaluation file.

Open the factsheet

Buying through a formal procurement? See How to buy for purchasing routes, accessibility conformance reports and company information. Documentation: Third-Party Risk Scoring guides on docs.moraph.com (getting started and security guides are public; setup, administration and integration guides are for client accounts). Support: Third-Party Risk Scoring support guide.

Related products