Third-Party Risk Scoring

Principal workflows

• Build the portfolio: Your vendor list is loaded into BitSight and each vendor is matched to the right organization and tiered by criticality, so monitoring effort follows risk.
• Monitor: BitSight updates ratings and findings continuously from externally observable evidence. Moraph's operations team receives the alerts and triages them against the vendor's tier and history.
• Follow up: For findings that need action, Moraph prepares a summary for the relationship owner and supports the conversation with the vendor, keeping a record until the finding is resolved or the risk accepted.
• Report: Ratings and findings feed your vendor risk assessments, onboarding and renewal decisions, and committee reporting.

Who uses it

• Third-party and vendor risk management teams at banks, credit unions, broker-dealers and insurers
• Chief information security officers and security teams who assess vendor security
• Business owners of critical vendor relationships
• Procurement and contract teams who need risk input at onboarding and renewal
• Risk committees, internal audit and examiners

Reporting

• Portfolio ratings by tier and business line
• Rating changes past tier thresholds
• Alert triage decisions
• Open follow-ups and risk acceptances
• Pre-contract ratings for prospective vendors
• Vendor monitoring history for audit and examiners

Features

• Security ratings: BitSight rates each monitored organization from externally observable evidence, so you can compare vendors and follow changes over time.
• Risk vector findings: BitSight shows the findings behind a rating, such as signs of compromised systems, exposed services, patching and configuration issues, and public breach disclosures.
• Portfolio monitoring: All monitored vendors in one view, grouped by tier, business line or relationship owner.
• Tier-based alert thresholds: Alert thresholds are set by vendor tier, so critical vendors raise alerts on smaller changes.
• Managed alert triage: Moraph's operations team reviews each alert, checks the evidence and classes it before anything reaches your relationship owners.
• Attribution checks: Findings that may belong to the wrong organization or to shared infrastructure are checked before they are acted on, and corrections are requested from BitSight where needed.
• Finding follow-up: Material findings are summarized for the relationship owner and tracked through the vendor's response to resolution or risk acceptance.
• Pre-contract rating: Prospective vendors are rated before contract, so procurement and the TPRM team see security posture alongside other due diligence.
• Vendor management integration: Ratings, tiers and open findings are shared with your vendor management system, including Moraph's Vendor Risk Management (VRM).
• Monitoring record: Every alert, triage decision, follow-up and outcome is recorded against the vendor, as evidence of ongoing monitoring.
• Portfolio reporting: Rating distribution, changes, open findings and follow-up status by tier, for the TPRM manager and risk committees.
• Monthly service review: A regular review of portfolio changes, significant findings, open follow-ups and service matters with your TPRM manager.

Integrations

• Vendor management system: Your vendor inventory and criticality come from your vendor management system, including Moraph's Vendor Risk Management (VRM), and ratings and open findings go back to it.
• Procurement and sourcing: Requests for pre-contract ratings come from your sourcing process, and results are attached to the sourcing file.
• GRC platform: Ratings and follow-up status can be shared with your governance, risk and compliance tool for enterprise risk reporting.
• Security operations: Significant vendor events can be passed to your security team's case or ticketing tools.
• Single sign-on: Users sign in through your identity provider (SAML or OpenID Connect) where supported by BitSight.
• Moraph service portal: Alerts, triage decisions, follow-ups and service reports are tracked in Moraph's service portal and available through the Moraph Work API.

Deployment

• BitSight service, run by Moraph: BitSight's hosted service, subscribed through Moraph, with Moraph's team operating the portfolio and monitoring work.
• Co-managed: Your team keeps some of the work, such as vendor follow-up, and Moraph runs portfolio maintenance, alert triage and reporting.
• With Vendor Risk Management: Run alongside Moraph's Vendor Risk Management (VRM), so ratings and findings sit with the rest of each vendor's due-diligence record.

Security and privacy

• Single sign-on: Your staff and Moraph's analysts sign in through identity providers with multi-factor authentication, so your access policies apply.
• Role-based access: Relationship owners see their own vendors; administering the platform is separate from deciding on findings.
• Confidential vendor information: Your vendor list, tiers and follow-up records are your confidential information and are shared only with the people and systems you approve.
• Encryption and keys: Data in Moraph's service portal is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.
• Complete audit trail: Alerts, triage decisions, follow-ups, risk acceptances and changes are logged with the person and time.
• Data residency: Moraph's service portal runs in the United States, United Kingdom or Australia region you choose; BitSight's hosting follows its own terms.

Limitations

• Moraph is not the vendor. BitSight owns the platform and its rating methods, and BitSight's own service commitments, roadmap and outages apply.
• Subscriptions are subject to BitSight's terms, which you accept as part of the agreement.
• Ratings are based on what can be observed from outside an organization. They do not replace questionnaires, document review, contract terms or on-site assessment.
• Findings can be misattributed, for example on shared hosting or recently changed networks. Moraph checks findings before follow-up, but some will need confirmation with the vendor.
• A good rating does not mean a vendor is secure, and a poor rating does not on its own mean a vendor should be dropped. Those judgments are your organization's.
• Moraph does not contact your vendors except through the channel you agree, and does not negotiate with them on your behalf.
• Moraph does not change BitSight ratings; corrections are requested from BitSight under its own process.
• Fourth parties and vendors outside your subscription are not monitored unless they are added to the portfolio.

Next steps

Book a demonstration or a technical briefing at www.moraph.com/solutions/third-party-risk-scoring. Purchasing routes and company information: www.moraph.com/how-to-buy.