# Creating and managing vendors

> A vendor record is built in a fixed order. Create it, complete the assessment questionnaire that produces its risk rating, then attach the supporting documents.

Source: https://tidalcontrol.com/docs/vendors/creating-and-managing-vendors

A vendor record is built in a fixed order: create it, complete its assessment questionnaire, which produces a risk rating automatically, attach the supporting documents, and then approve it. It stays a Draft until you do.

## Creating a new vendor

A vendor starts as a Draft and stays there until its assessment is complete.

### Vendor addition process

1. **Click "Add vendor"** top right in Vendors overview
2. **"Create a new Vendor" dialogue opens**
3. **Search for a vendor or add** - Type vendor name
4. **Assign owner** - Select responsible person (optional)
5. **Description** - Add description (optional, markdown supported)
6. **Click "Create"** to create vendor

![Create new vendor dialog](/images/help/vendors_add.png)

**Initial vendor setup:**
- **Status:** Automatically "Draft"
- **Assessment:** Empty, must be completed
- **Rating:** Determined after assessment completion
- **Owner:** Assigned person or to be assigned later

## Completing vendor assessment

The assessment determines risk classification and compliance requirements for the vendor.

### Completing assessment questionnaire

**Go to Assessment tab** of vendor detail panel and answer all questions:

![Vendor Assessment Tab](/images/help/vendors_assessment_tab.png)

**Data Access Level:**
- **No access** - No access to systems or data
- **Limited access** - Limited access to non-sensitive data
- **Full access to sensitive/regulated data** - PII, financial, health data

**Data Processing Type:**
- **No data processing** - Physical services only
- **Basic business data** - Non-sensitive operational data
- **Sensitive personal data** - Names, addresses, contact details
- **Regulated data** - Financial, health, government data

**Business Criticality:**
- **Low impact** - Minimal business disruption if unavailable
- **Moderate impact** - Some operational impact
- **Highly important** - Significant business impact from disruption
- **Business critical** - Core operations dependent on service

**Regulatory Jurisdictions (optional):**
- Select relevant jurisdictions where vendor operates
- For example: EU/EEA, US, Asia-Pacific
- Influences compliance requirements

**Vendor Scope (optional):**
- **Limited scope** - Specific project or service
- **Department level** - Service for one department
- **Organisation wide** - Service for entire organisation

### Automatic risk rating determination

After assessment completion, Tidal automatically calculates the risk rating:
- **High:** Critical business services, sensitive data and/or legal scope
- **Medium:** Moderate impact, limited data access and/or standard compliance
- **Low:** Minimal impact, no data processing and/or low-risk services

## Configuring vendor details

The Details tab holds the vendor's own information, separate from its assessment answers.

### Completing Details tab

Nothing entered here affects the risk rating; that comes from the assessment itself.

**Basic vendor information:**
- **Description:** Description of vendor services
- **Website:** Official vendor website URL
- **Vendor contact:** Primary contact person on vendor side

**Compliance and security information:**
- **Security page:** Link to vendor security documentation
- **Privacy policy:** URL to vendor privacy policy
- **Jurisdiction:** Legal jurisdiction of vendor (e.g. UK/EU)

**Internal management:**
- **Owners:** Add internal owners of vendor relationship

![Vendor details configuration](/images/help/vendors_details_tab.png)

## Document management

Vendor documents are the evidence behind the assessment: certifications, reports, and agreements.

### Document upload process

1. **Go to Documents tab** in vendor detail panel
2. **Click "Upload Document"** 
3. **Document Type** manually select
4. **Select document** from computer

### Document types

Which documents you need depends on the vendor's risk level, but a privacy policy and security assurance cover most cases.

**Types of compliance documents:**
- **Privacy Policy** - Vendor's privacy policy and personal data handling
- **Security Assurance** - Security certifications and reports (e.g. ISO 27001, SOC 2)
- **Data Processing Agreement** - GDPR/privacy compliant processor agreement
- **Vendor Contract** - Primary contract with vendor

**Document tracking:**
- **Upload Date** - When document was added
- **Uploaded By** - Who uploaded the document
- **Document Type** - Categorisation for compliance

![Document management](/images/help/vendors_documents_tab.png)

## Vendor approval workflow

Approving a vendor is a deliberate step after the assessment, and what you should require before approving depends on the risk rating.

### Draft to Approved process

A vendor is ready to approve once its assessment, rating, and required documents are all in place.

**Recommended approval requirements:**
1. **Assessment completed** - All mandatory questions answered
2. **Risk rating determined** - Classification assigned
3. **Required documents** uploaded per risk level
4. **Owner assigned** - Responsible person assigned

**Approving a vendor:**
1. **Go to vendor** actions menu (three dots)
2. **Select "Approve Vendor"**
3. **Status changes to "Approved"** and "Approved" date is automatically set

![Vendor approval options](/images/help/vendors_approve.png)

### Recommended approval criteria per risk level

What you should require before approving scales with the risk rating: more evidence and more frequent reassessment for high-risk vendors.

**High risk vendors:**
- **Risk assessment:** All questions answered and deemed acceptable
- **Documents** - All documents uploaded and reviewed
- **Quarterly or bi-annual** reassessment

**Medium risk vendors:**
- **Risk assessment:** Mandatory questions answered and deemed acceptable
- **Documents** - At least contract and certification uploaded and reviewed
- **Annual** reassessment

**Low risk vendors:**
- **Risk assessment:** Mandatory questions answered and deemed acceptable
- **Documents** - At least contract uploaded and reviewed
- **Annual or triennial** reassessment

### Managing multiple vendors simultaneously

Selecting several vendors at once lets you reassign, approve, archive, or delete them in a single action.

**Available bulk operations:**
- **Change assignee** - Assign new owner to group of vendors
- **Archive** - Archive multiple vendors at once
- **Approve** - Approve multiple vendors at once
- **Delete** - Remove multiple vendors from system at once

**Bulk workflow:**
1. **Select vendors** with checkboxes on left in overview
2. **Relevant buttons appear** at top of table
3. **Choose desired action** and confirm

## Next steps

Now you can create and manage vendors:
- **Start with critical vendors** for immediate risk assessment
- **Develop document templates** for efficient and consistent application of compliance requirements
- **Plan periodic review cycles** for vendor portfolio management
- **Train vendor owners** in assessment and approval procedures