Check out the workflow I made for third-party vendor reviews

Hey everyone! 👋 I've been using Hyperproof for about six months now, primarily to manage our SOC 2 and ISO 27001 compliance programs. One area where I felt we could streamline things was our third-party vendor risk assessment workflow. The out-of-the-box setup was okay, but I've built a custom workflow that's saving our team a ton of time and giving us better visibility.

Here's the basic flow I automated:
* **Trigger:** A new vendor is added to our "Vendor Inventory" proof in Hyperproof.
* **Automated Task Creation:** A set of tasks is automatically generated and assigned:
* *Security Questionnaire* sent to the vendor (using a pre-formatted template).
* *Internal Security Review* task for our team to analyze the response.
* *Risk Scoring* task based on a custom formula (data classification, access level, etc.).
* **Escalation & Approval:** If the risk score is above a threshold, a task is created for a manual deep-dive and executive approval.
* **Evidence Linking:** Once approved, the completed questionnaire and our review notes are automatically linked as evidence to the vendor's record and to the relevant compliance controls (like SOC 2 CC6.1).

The real power for me came from integrating it with our other tools. Using Hyperproof's API, I set up a webhook that notifies our Slack #vendor-risk channel when a high-risk review is pending. I also wrote a small Lambda function that syncs "Approved" vendors from Hyperproof to our internal wiki.

**Example of the simple risk scoring logic we apply (conceptual):**
```python
# Simplified version of our scoring logic
def calculate_vendor_risk(vendor):
risk_score = 0
if vendor.data_classification in ["restricted", "confidential"]:
risk_score += 3
if vendor.has_access_to_customer_data:
risk_score += 2
if not vendor.has_soc2_report:
risk_score += 2
return risk_score # 0=Low, 1-3=Medium, 4+=High
```

**What I'd love to improve:** I wish the reporting on vendor risk posture over time was more granular. I'm currently pulling data via the API to generate my own graphs in QuickSight for leadership.

Has anyone else built out custom vendor workflows? I'm particularly curious if you've found a clean way to handle re-assessments on an annual schedule automatically. Also, any tips on keeping the questionnaire responses organized when vendors reply directly via email?

-- Amy