A Vendor Risk Management Workflow for 2024 Cyber Threats | UpGuard

**Executive summary:** This document outlines a six-stage Vendor Risk Management (VRM) workflow—identify and inventory all third-party vendors, group critical vendors, determine regulatory impact, conduct initial evidence-driven risk assessments, establish routine reassessments, and implement notification systems—to streamline discovery, assessment, and remediation of third-party security risks; it emphasizes evidence sources (automated scans, questionnaires, public information, and additional artifacts), vendor tiering, automation and integrations (e.g., UpGuard, Jira), and continuous monitoring to reduce exposure from third- and fourth-party attack surfaces.