One control model, not a separate spreadsheet
Vendor findings map to the same universal controls MyTrustForge uses for your own posture. A weak vendor control shows up where it matters: against the control it affects.
cybrgen.nz / v-roc
Managed third-party riskVendor risk, run for you on MyTrustForge.
V-ROC is CybrGen's managed vendor risk service. We run your third-party risk programme inside MyTrustForge, so every vendor finding sits on the same control model as your own security posture.
Our approach is in use at Auckland Transport, where CybrGen designed the third-party risk policy, process and tiered vendor questionnaires.
Assessment depth by tier
Vendor Trust · MTFTier 1 · Critical
Full questionnaire, evidence review and contract check
Tier 2 · High
Full questionnaire with targeted evidence
Tier 3 · Medium
Standard questionnaire
Tier 4 · Low
Short questionnaire and register entry
Every tier feeds the same register and control model, so effort scales with risk without fragmenting the record.
Why V-ROC
Third-party risk as part of your control posture, not a side project
Most vendor programmes assess once, file the questionnaire and move on. V-ROC runs vendor risk as an ongoing function on the same platform as the rest of your trust operations.
What each vendor actually covers for you
Control inheritance analysis classifies controls as inherited from the vendor, shared, or still your responsibility. That is the question auditors and boards ask, answered per vendor.
Effort follows risk
Vendors are tiered by criticality, data access and regulatory exposure. Critical vendors get evidence review; low-risk vendors get a short questionnaire. No one-size-fits-all survey.
Your register, your evidence
The vendor register, questionnaires, evidence and decisions live in MyTrustForge, not in a consultant's inbox. The history stays with you.
How it works
Five steps, one record
- 01
Inventory and tier
Load your vendors into the MyTrustForge register and tier them by criticality, data access and regulatory exposure.
- 02
Right-sized assessment
Send tier-appropriate questionnaires, review evidence for critical vendors and record findings against controls.
- 03
Map control inheritance
Confirm which controls each vendor covers for you, which are shared and which remain yours.
- 04
Follow up and keep current
Track remediation, reassess on a cadence set by tier and keep vendor risk scores current between reviews.
- 05
Report to governance
Give your risk committee a clear view of vendor exposure, open findings and decisions, backed by evidence.
Ways to engage
Start where you are
Every engagement is scoped by vendor count and tiering, so you pay for the depth your vendor base needs.
Project
Programme setup
We stand up your vendor risk programme and hand it over to run in-house.
- Third-party risk policy and process
- Tiering method and questionnaire set
- Vendor Trust configured in MyTrustForge
- First reviews of your critical vendors
Managed service
V-ROC managed
We run the vendor risk function for you, inside your MyTrustForge tenant.
- Everything in programme setup
- Ongoing assessments and follow-ups
- Reassessment cadence by tier
- Reporting for your risk committee
One-off
Critical vendor review
An evidence-based review of one high-risk vendor, before you sign or renew.
- Security questionnaire and evidence review
- Contract and data-handling check
- Findings mapped to your controls
- Clear accept, mitigate or escalate view
Need a quick first look at a single vendor?
VsecNow runs an indicative outside-in scan of a vendor's public security signals. It is a fast first look, not an assessment.
Know what your vendors cover, and what they leave to you.
Tell us how many vendors you work with and which ones worry you most. We will come back with a scoped approach within one business day.