Product News: Risk Register, Vendor Risk Management, and Privacy Assessments

Three additions to the compliance side of Concord: a risk register, risk management for the vendors you already track, and privacy assessments you can build, share, and approve in one place. You can also now choose the scope of your SOC 2 report.

Risk Register

Open Risks in the Data Hub to start a register from Concord's library of risk scenarios, covering areas like data breach, insider threat, third parties and supply chain, availability, access control, fraud, and privacy, or write your own. Each library scenario shows the framework it comes from and the controls it recommends.

• Score likelihood and impact. Risks are scored on a 5×5 grid, with an inherent score and, once a risk is mitigated or transferred, a residual score. Four bands (Low, Medium, High, Critical) are set by default, and you can rename them and change their ranges and colors under Risk Scoring.
• Choose a treatment. Mitigate, accept, transfer, or avoid, with a required rationale so the decision is on record. Give a treatment a target date and its owner gets a task.
• Link controls. Connect a risk to the controls that address it and see each control's current status from the risk.
• Keep reviews on schedule. Set a quarterly, semi-annual, or annual review, and when an open risk's review is overdue, its owner gets a task.
• See your posture. One heatmap you can switch between inherent and residual scores, plus counts of untreated risks, overdue reviews, and risks with no linked control. Click any cell or count to filter the register.
• Bring your spreadsheet. Import risks from CSV, and export the register whenever you need it.

Risk Reports capture the register at a point in time, so a report you shared last quarter still shows what it showed then. Download one as a PDF with your logo, or save a copy to your document library. Under Global Settings > Branding, choose which exports carry your branding: risk reports, ROPA reports, questionnaires and RFPs, and policies and documents.

Vendor Risk Management

Your vendor inventory now carries risk.

• Risk tiers, suggested for you. Each vendor gets a suggested tier based on the sensitivity of the data systems it's linked to and the kind of service it provides. Mark whether a vendor uses AI, has privileged access, or trains AI on your customers' data, and the suggestion accounts for it. Override the tier and your choice sticks.
• Required evidence by tier. Critical vendors call for a SOC 2 report, a penetration test, and a DPA. High-tier vendors call for a SOC 2 report and a DPA, and medium-tier vendors a SOC 2 report. Any vendor handling regulated data needs a DPA. Each item shows as present, missing, or expired.
• Reviews. By default, critical vendors are reviewed every six months and the rest yearly, and you can set each vendor to quarterly, semi-annual, or annual reviews. Start a review any time, for example after a vendor incident, and turn its findings into a risk in your register directly from the review.
• Documents that don't quietly expire. Upload SOC 2 reports, ISO 27001 certificates, penetration tests, insurance certificates, questionnaires, and DPAs (or link to a vendor's published DPA) with expiry dates. When a document is about to expire, Concord opens a task for the vendor's security owner.

Privacy Assessments

The new Assessments add-on brings DPIAs and PIAs into Concord, under Data Hub > Assessments.

• Start from a template. Use one of your own templates or one of eight from Concord's library: Data Protection Impact Assessment (GDPR), Privacy Impact Assessment, Risk Assessment (California CCPA/CPRA), Data Protection Assessment (US States), Transfer Impact Assessment, Legitimate Interests Assessment, Fundamental Rights Impact Assessment (EU AI Act), and a Fundamental Rights Section to add to a DPIA. The EU AI Act templates are provisional until the EU AI Office publishes its official template. You can also customize any Concord template into your own copy.
• Build your own. A drag-and-drop builder with conditional logic and a live preview as you build. Publish when you're ready for people to use your changes.
• Start from what you know. Answers can prefill from the processing activities and systems in your data map, each marked with where it came from.
• Answer it together. Assign teammates to the whole assessment, a section, or a single question. Invite a vendor or other outside contact by email: they sign in with a one-time passcode, see only the part you share, and the invite expires after 7 days. Answers save as you go.
• Record risks and approve. Record risk findings with likelihood, severity, and mitigation, raise them into your risk register, and track completion, open risks, and due dates on the assessment's record. Approving an assessment locks it and keeps an unchangeable copy of what was approved.

Choose Your SOC 2 Report Scope

When you adopt SOC 2, choose which Trust Services Categories your report covers under Report Scope. Security is always included, and you can add Availability, Confidentiality, Processing Integrity, and Privacy. Requirements outside your scope stay out of your coverage and your auditor's view. Change the scope later from the framework's Details tab.

Get Started

Assessments is an add-on for Concord Privacy Premium and Enterprise at $199/month billed annually. The risk register and vendor risk management are included in Concord Trust Premium and Enterprise. Book a demo and we'll walk you through it.