Third-Party Risk Scoring

Moraph resells, implements and runs BitSight to monitor the security posture of your vendors and other third parties between assessments. BitSight rates each organization from externally observable evidence and alerts when a rating or finding changes; Moraph sets up your vendor portfolio, triages the alerts, follows up material findings with the relationship owner, and reports on the portfolio. Your third-party risk team decides what a finding means for the relationship.

The problem it solves

Most third-party risk programs assess vendors through questionnaires and document reviews at onboarding and then once a year or less. Between reviews, a vendor can expose a vulnerable service, show signs of compromised machines or suffer a breach, and the institution hears about it from the news or not at all. Teams that buy security ratings often find they lack the people to watch the alerts, check whether a finding is real, and chase it with the vendor, so the subscription becomes a dashboard nobody acts on.

Who it’s for

• Third-party and vendor risk management teams at banks, credit unions, broker-dealers and insurers
• Chief information security officers and security teams who assess vendor security
• Business owners of critical vendor relationships
• Procurement and contract teams who need risk input at onboarding and renewal
• Risk committees, internal audit and examiners

1. Build the portfolioYour vendor list is loaded into BitSight and each vendor is matched to the right organization and tiered by criticality, so monitoring effort follows risk.
2. MonitorBitSight updates ratings and findings continuously from externally observable evidence. Moraph's operations team receives the alerts and triages them against the vendor's tier and history.
3. Follow upFor findings that need action, Moraph prepares a summary for the relationship owner and supports the conversation with the vendor, keeping a record until the finding is resolved or the risk accepted.
4. ReportRatings and findings feed your vendor risk assessments, onboarding and renewal decisions, and committee reporting.

Security ratings

BitSight rates each monitored organization from externally observable evidence, so you can compare vendors and follow changes over time.

Risk vector findings

BitSight shows the findings behind a rating, such as signs of compromised systems, exposed services, patching and configuration issues, and public breach disclosures.

Portfolio monitoring

All monitored vendors in one view, grouped by tier, business line or relationship owner.

Tier-based alert thresholds

Alert thresholds are set by vendor tier, so critical vendors raise alerts on smaller changes.

Managed alert triage

Moraph's operations team reviews each alert, checks the evidence and classes it before anything reaches your relationship owners.

Attribution checks

Findings that may belong to the wrong organization or to shared infrastructure are checked before they are acted on, and corrections are requested from BitSight where needed.

Finding follow-up

Material findings are summarized for the relationship owner and tracked through the vendor's response to resolution or risk acceptance.

Pre-contract rating

Prospective vendors are rated before contract, so procurement and the TPRM team see security posture alongside other due diligence.

Vendor management integration

Ratings, tiers and open findings are shared with your vendor management system, including Moraph's Vendor Risk Management (VRM).

Monitoring record

Every alert, triage decision, follow-up and outcome is recorded against the vendor, as evidence of ongoing monitoring.

Portfolio reporting

Rating distribution, changes, open findings and follow-up status by tier, for the TPRM manager and risk committees.

Monthly service review

A regular review of portfolio changes, significant findings, open follow-ups and service matters with your TPRM manager.

TPRM manager

Owns the program, approves tiers and thresholds, and decides on escalations and risk acceptance

Relationship owner

Owns a vendor relationship, takes findings to the vendor and records the response

Security analyst

Assesses the technical substance of findings and advises on their significance

Procurement

Requests ratings for prospective vendors and sees ratings at renewal

Moraph service team

Maintains the portfolio, triages alerts, prepares finding summaries and reports

Auditor or examiner (read-only)

Reviews monitoring records, decisions and reports

Vendor management system

Your vendor inventory and criticality come from your vendor management system, including Moraph's Vendor Risk Management (VRM), and ratings and open findings go back to it.

Procurement and sourcing

Requests for pre-contract ratings come from your sourcing process, and results are attached to the sourcing file.

GRC platform

Ratings and follow-up status can be shared with your governance, risk and compliance tool for enterprise risk reporting.

Security operations

Significant vendor events can be passed to your security team's case or ticketing tools.

Single sign-on

Users sign in through your identity provider (SAML or OpenID Connect) where supported by BitSight.

Moraph service portal

Alerts, triage decisions, follow-ups and service reports are tracked in Moraph's service portal and available through the Moraph Work API.

Single sign-on

Your staff and Moraph's analysts sign in through identity providers with multi-factor authentication, so your access policies apply.

Role-based access

Relationship owners see their own vendors; administering the platform is separate from deciding on findings.

Confidential vendor information

Your vendor list, tiers and follow-up records are your confidential information and are shared only with the people and systems you approve.

Encryption and keys

Data in Moraph's service portal is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Alerts, triage decisions, follow-ups, risk acceptances and changes are logged with the person and time.

Data residency

Moraph's service portal runs in the United States, United Kingdom or Australia region you choose; BitSight's hosting follows its own terms.

BitSight service, run by Moraph

BitSight's hosted service, subscribed through Moraph, with Moraph's team operating the portfolio and monitoring work.

Co-managed

Your team keeps some of the work, such as vendor follow-up, and Moraph runs portfolio maintenance, alert triage and reporting.

With Vendor Risk Management

Run alongside Moraph's Vendor Risk Management (VRM), so ratings and findings sit with the rest of each vendor's due-diligence record.

Program alignment

We review your third-party risk policy and tiering with your TPRM manager and agree how ratings will be used, who receives findings and how vendors are contacted.

Portfolio load

Your vendor list is loaded and each vendor matched to its BitSight organization record. We need an export from your vendor management system and help from relationship owners on uncertain matches.

Tiers and thresholds

Vendors are tiered from your existing criticality ratings, and alert thresholds are set for each tier for your TPRM manager to approve.

Baseline review

Current ratings and open findings across the portfolio are reviewed, and the findings that need follow-up are agreed with you.

Integration and access

Single sign-on, roles and the link to your vendor management system are set up, and relationship owners are trained on what they will receive.

Handover to service

Alert triage, follow-up tracking, reporting and the monthly service review start under Moraph's managed service.

• Moraph is not the vendor. BitSight owns the platform and its rating methods, and BitSight's own service commitments, roadmap and outages apply.
• Subscriptions are subject to BitSight's terms, which you accept as part of the agreement.
• Ratings are based on what can be observed from outside an organization. They do not replace questionnaires, document review, contract terms or on-site assessment.
• Findings can be misattributed, for example on shared hosting or recently changed networks. Moraph checks findings before follow-up, but some will need confirmation with the vendor.
• A good rating does not mean a vendor is secure, and a poor rating does not on its own mean a vendor should be dropped. Those judgments are your organization's.
• Moraph does not contact your vendors except through the channel you agree, and does not negotiate with them on your behalf.
• Moraph does not change BitSight ratings; corrections are requested from BitSight under its own process.
• Fourth parties and vendors outside your subscription are not monitored unless they are added to the portfolio.

• Share a sample of your critical vendors and review their ratings and findings with Moraph
• Ask how a recent alert on one of them would be triaged and summarized
• Agree draft tiers and thresholds and see how many alerts they would have produced
• Walk through a follow-up from finding to recorded outcome
• Check the responsibilities table against your own operating model
• Review a sample vendor monitoring history against what your examiners ask for