​
Overview

LowerPlane provides a comprehensive Third-Party Risk Management (TPRM) program that gives you full visibility into your vendor ecosystem. Every vendor relationship follows a structured lifecycle, ensuring that no third-party risk goes untracked.

Managed Vendors

Central directory of all approved vendors with status tracking, risk levels, and compliance metadata.

Vendor Intake

Public intake forms that let vendors or employees submit onboarding requests for review and approval.

Risk Assessments

Questionnaire-based assessments with domain-weighted scoring and multi-level risk classification.

Documents

Upload, categorize, and track vendor compliance documents with expiry monitoring and AI scanning.

Subprocessors

Track third-party subprocessors that your vendors rely on, including data categories and hosting locations.

Vendor Scoring

Configurable risk scoring formula based on boolean risk factors, custom weights, and threshold levels.

​
Vendor Lifecycle

The TPRM program follows a six-stage lifecycle. Each stage maps to features within the platform.
1

Discovery

New vendors are identified through auto-discovery from expenses and integrations, or manually added by your team. Enable auto-discovery in Vendor Settings > General to scan on a configurable schedule (hourly, daily, or weekly).
2

Intake

Vendors or internal employees submit onboarding requests through a public intake form. Each submission captures company details, data handling practices, and custom fields defined by your organization.
3

Onboarding

Submitted vendors go through an approval workflow. Reviewers assess the intake submission, check the auto-calculated risk score, and approve or reject the request. Approved vendors are added to the managed vendor directory.
4

Risk Assessment

Approved vendors undergo a formal risk assessment using questionnaire templates. Assessments cover multiple domains (security, privacy, compliance, business continuity) with weighted scoring. Vendors can self-serve the questionnaire through a shareable link.
5

Monitoring

Active vendors are continuously monitored for risk signals, document expirations, and compliance drift. The overview dashboard surfaces key metrics including vendors by risk level, expiring documents, and overdue assessments.
6

Offboarding

When a vendor relationship ends, the offboarding process ensures data return or destruction is confirmed, access is revoked, and the vendor record is archived with a full audit trail.

​
TPRM Dashboard

The vendor overview dashboard provides a real-time snapshot of your third-party risk posture. Key metrics include:
  • Total Vendors — count of all managed vendors with trend indicators
  • Risk Distribution — breakdown of vendors by risk level (critical, high, medium, low)
  • Assessment Coverage — percentage of vendors with completed risk assessments
  • Document Health — expiring and expired compliance documents requiring attention
  • Risk Signals — real-time monitoring alerts from integrated security tools
Use the TPRM dashboard as your daily starting point. It highlights the vendors and documents that need immediate attention, so you can prioritize your review queue effectively.

​
Vendor Categories

Vendors are organized into categories for filtering and reporting:

​
Risk Levels

Every vendor is assigned a risk level based on their assessment score and intake risk factors:
Vendors classified as Critical or High risk should have a completed risk assessment and up-to-date compliance documents before being approved for production use.

​
Integration with Compliance

Vendor management feeds directly into your compliance program:
  • Evidence collection — vendor documents (SOC 2 reports, ISO certificates, pen test reports) serve as evidence for your own framework controls
  • Control mapping — vendor risk assessments map to specific controls across 50+ compliance frameworks
  • GDPR compliance — subprocessor tracking supports Records of Processing Activities (ROPA) and Data Processing Agreements (DPA)
  • Audit readiness — the complete vendor inventory with risk scores and assessment history provides auditors with the documentation they need

​
Next Steps

Vendor Intake

Set up public intake forms for vendor onboarding requests.

Risk Assessments

Create and manage questionnaire-based vendor assessments.

Vendor Scoring

Configure your organization’s risk scoring formula.

Vendor Settings

Configure discovery, notifications, and approval workflows.