ServiceNow Third Party Risk Management helps organizations track and manage the security risks that come with working with outside vendors and suppliers. Security teams, procurement departments, and IT managers use it to make sure vendors meet security standards before they get access to company systems or data. It handles everything from sending risk questionnaires to new vendors to monitoring ongoing compliance and flagging when vendor risk levels change. The module connects vendor management to your existing ServiceNow workflows, so vendor approvals can automatically trigger in IT Service Management, and security incidents can link back to vendor risk profiles. Once it's running, you get a single place to see all vendor relationships, their risk scores, contract renewal dates, and any security issues. Vendors can log into a self-service portal to complete questionnaires and update their information, reducing the back-and-forth emails that usually slow down vendor onboarding.
Key Capabilities
Vendor Self-Service Portal
Vendors log into their own portal to complete risk questionnaires, upload certifications, and update their company information. This eliminates the email chains and missing documents that normally delay vendor approvals. Security teams get complete responses faster and can track which vendors haven't responded yet.
Automated Risk Scoring
The system calculates risk scores based on questionnaire responses, integrations with external risk rating services like BitSight or SecurityScorecard, and contract terms. Scores update automatically when new information comes in. High-risk vendors get flagged for additional review before they can be approved.
Contract and Renewal Tracking
All vendor contracts, security requirements, and renewal dates live in one place with automated reminders. Teams can see which vendors need security reviews before renewal and track whether vendors are meeting their contractual security obligations. No more scrambling when contracts expire unexpectedly.
Risk Assessment Workflows
Custom workflows route high-risk vendors to security teams for manual review while low-risk vendors get approved automatically. The system tracks who approved what and when, creating an audit trail for compliance. Escalation rules ensure nothing sits in someone's queue too long.
Ongoing Risk Monitoring
Risk scores update continuously as external risk services provide new data about vendor security posture. When a vendor's risk level changes significantly, the system automatically creates tasks for the security team to investigate. This catches security issues before they become incidents.
Integration with External Risk Services
Direct connections to services like BitSight, SecurityScorecard, and RiskRecon pull in real-time security ratings and breach notifications. These external scores combine with internal questionnaire data to give a complete risk picture. Teams don't have to manually check multiple risk platforms.
Vendor Risk Reporting
Dashboards show vendor risk distribution, overdue assessments, and trending risk scores across the vendor portfolio. Executives get summary reports while security teams get detailed views of individual vendor issues. Reports automatically generate for compliance audits and board presentations.
How It Works
When someone wants to work with a new vendor, they create a vendor record in ServiceNow, which triggers the risk assessment process. The vendor receives an email invitation to complete security questionnaires through their self-service portal, while ServiceNow pulls in external risk ratings from integrated services. Based on the combined risk score, the system either auto-approves low-risk vendors or routes high-risk ones to security teams for manual review. Once approved, the system continues monitoring the vendor's risk profile and sends alerts when risk levels change significantly or contracts need renewal.
Who Uses It and How
Regional bank
Uses Third Party Risk Management to assess fintech partners and cloud service providers before they can access customer data. All vendors complete detailed security questionnaires and get scored based on their responses plus external risk ratings. High-risk vendors require additional security reviews and enhanced monitoring.
Result: Reduced vendor onboarding time from 6 weeks to 2 weeks while maintaining strict security standards.
Healthcare system
Tracks risk for medical device vendors, software suppliers, and facilities management companies that need access to hospital networks. The system monitors for data breaches at vendor companies and automatically creates security review tasks when vendor risk scores spike.
Result: Caught three vendor security incidents before they impacted patient systems, avoiding potential HIPAA violations.
Manufacturing company
Manages risk for suppliers in their global supply chain, focusing on vendors who have remote access to production systems or handle sensitive product designs. Vendors complete questionnaires annually with automatic reminders for renewals, and contract terms get tracked alongside security requirements.
Result: Eliminated manual spreadsheet tracking for 800+ vendors and ensured 100% completion of annual security assessments.
University IT department
Evaluates ed-tech vendors, research partners, and student service providers who need access to student data or campus networks. The vendor portal lets suppliers upload current security certifications and SOC 2 reports, while staff track compliance with FERPA requirements.
Result: Standardized vendor security reviews across all departments and reduced approval delays for academic software purchases.
Sourdough: ServiceNow Monitoring and Analytics
A Chrome extension for ServiceNow Admins and Developers with essential tools, analytics, graphs and monitoring features.
Free to install. Pro $5/month after a 14-day no-card trial.
Pro requires the ServiceNow admin role. Upgrade inside the extension.
Implementation: What to Know
You'll need security, procurement, legal, and IT teams working together since they all interact with vendors differently and have different risk concerns. Plan for 3-6 months to get the basic workflows running, but expect another 6 months to fine-tune risk scoring and get all stakeholders comfortable with the new process. Clean up your existing vendor data first and decide on risk scoring criteria before you start building workflows. Most implementations slow down when teams can't agree on what makes a vendor 'high risk' or when they try to migrate years of messy vendor spreadsheets without cleaning them up first.
Common Use Cases
Marketing team wants to use a new survey platform that will collect customer email addresses
The marketing manager creates a vendor request in ServiceNow, which sends security questionnaires to the survey company. The vendor fills out questions about data encryption and privacy practices through their portal. Based on the responses and external security ratings, the system calculates a risk score and either approves the vendor automatically or sends it to the security team for additional review.
Procurement discovers that a key software vendor was mentioned in a security breach news article
The integrated risk monitoring service detects the breach and automatically updates the vendor's risk score in ServiceNow. This triggers an alert to the security team and creates a task to assess whether the breach affects services provided to the company. The security team uses the task to document their investigation and any required actions.
Finance team gets audit request asking for security documentation on all vendors with access to financial systems
They run a report from Third Party Risk Management that shows all vendors categorized as having financial system access, their current risk scores, completed questionnaires, and security certifications. The report includes approval dates and reviewer names, providing the complete audit trail auditors need.
A cloud storage vendor's contract is up for renewal but their security score has dropped since the initial approval
The system flags the risk score change and creates a renewal review task for the security team. They can see what caused the score drop, review updated questionnaire responses, and decide whether to renew with additional security requirements or find a different vendor.
IT team needs to quickly onboard a temporary vendor to help with a critical system outage
They create an expedited vendor request that sends abbreviated security questions to the vendor while pulling external risk ratings in real-time. The system can approve low-risk vendors immediately for temporary access while creating follow-up tasks to complete full security reviews within a specified timeframe.
Key Tables
sn_vdr_vendorsn_vdr_risk_assessmentsn_vdr_questionnairesn_vdr_vendor_contractsn_vdr_risk_indicatorBest Practices
- ✓Set up different questionnaire templates for different vendor types rather than using one massive questionnaire for everyone
- ✓Configure risk scores to weight external ratings heavily for technical vendors but emphasize questionnaire responses for service providers
- ✓Create vendor categories that match how your procurement team already thinks about vendors to reduce confusion during rollout
- ✓Start with a small pilot group of vendors rather than trying to migrate your entire vendor database at once
- ✓Set realistic SLAs for security reviews because bottlenecks in approval workflows will frustrate business teams and hurt adoption
- ✓Train your vendors on the self-service portal before you need them to use it, not during urgent onboarding situations
Common Pitfalls
Making risk questionnaires too long and detailed, causing vendors to abandon them halfway through
Use shorter, targeted questionnaires based on vendor type and risk level. Save the detailed questions for high-risk vendors only.
Setting risk scoring thresholds too conservatively, making almost every vendor appear high-risk
Calibrate your scoring against a sample of known good vendors first, then adjust thresholds so only genuinely risky vendors need manual review.
Not training business teams on the new vendor request process, leading to shadow IT and bypassed approvals
Create simple how-to guides for common vendor scenarios and embed vendor requests into existing business processes rather than making them separate.
Trying to track every vendor relationship from day one, including low-risk suppliers like office snacks and cleaning services
Focus initially on vendors with system access, data handling, or contracts over a certain dollar amount. Add other vendor types gradually.
Not connecting Third Party Risk Management to your incident management process when vendor-related security issues occur
Configure incidents to link back to vendor records so you can see patterns and update risk scores based on actual security events.
Frequently Asked Questions
What's the difference between Third Party Risk Management and regular vendor management?
Regular vendor management focuses on contracts, payments, and performance. Third Party Risk Management specifically tracks security and compliance risks that vendors might introduce to your organization. It includes security questionnaires, risk scoring, and ongoing monitoring that regular vendor management doesn't cover.
Do we need Third Party Risk Management if we already have Vendor Risk Management?
ServiceNow's Third Party Risk Management is the newer, more complete version of Vendor Risk Management. It includes all the VRM functionality plus better external integrations, improved vendor portals, and more sophisticated risk scoring. Most organizations should use TPRM instead of the older VRM module.
How long does it take vendors to complete the security questionnaires?
It depends on the questionnaire length and vendor size, but most vendors complete basic questionnaires in 30-45 minutes. Larger vendors with dedicated security teams are usually faster, while small vendors might need a few days to gather all the required information.
Can we customize the risk scoring to match our industry requirements?
Yes, you can adjust risk scoring weights, add custom risk factors, and create industry-specific questionnaires. Many organizations start with the default scoring and then refine it based on their actual vendor experiences and regulatory requirements.
What external risk rating services does it integrate with?
ServiceNow has built-in integrations with BitSight, SecurityScorecard, RiskRecon, and several other risk rating providers. These integrations pull in security scores, breach notifications, and other risk indicators automatically to supplement your internal questionnaire data.
Do I need GRC to use Third Party Risk Management?
No, Third Party Risk Management works independently, though it integrates well with GRC if you have it. TPRM focuses specifically on vendor risks while GRC covers broader governance and compliance across your entire organization.
What happens if a vendor refuses to complete the security questionnaire?
The system can flag incomplete questionnaires and send automatic reminders. You can configure escalation workflows that notify business stakeholders when vendors don't respond, helping them decide whether to require completion or find alternative vendors.
Related Modules
Test Your Knowledge
Quick 3-question quiz — see how your ServiceNow skills stack up.
A list view on a table with millions of records is slow. Best fix?
Select an answer to continue