We have sunsetted Atlas. Use the Questionnaires tool for all your questionnaire management operations.
Once a vendor submits their completed questionnaire, you can access and evaluate their responses directly within the platform. This process allows you to verify that the vendor meets your organization's security requirements. After conducting your review, you can formally accept the submission to document that the assessment has been completed and verified.
Start a review
To begin evaluating a vendor's responses:
- Go to Communications > Questionnaires > Outgoing.
- Select the In review widget to filter the list and display only the questionnaires ready for evaluation.
- Find the specific questionnaire and select Begin review.
Review questionnaire responses
To view a vendor's response:
- Go to Communications > Questionnaires > Outgoing.
- Select Begin review on a questionnaire with an In review status.
- Click on any question in the panel on the left to open its main view.
The main view displays the vendor's response and any comments they have provided. To assign the question or the entire category of questions to another reviewer in your organization, select the appropriate option and then select the reviewer.
Beneath the response area, you will find a toolbar with several tabs to manage the review process.
The following options are available:
Evidence: View any documentation provided by the vendor to support their answer.
-
Messaging: Send messages about a specific vendor response. Before sending, choose who can see your message:
Audience Who sees it When to use Everyone Your team and the vendor Ask the vendor for clarification, request additional evidence, or follow up on their answer Your Team (Early Access) Only colleagues in your organization with reviewer permissions. The vendor cannot see these. Leave internal notes, flag a concern for a colleague, or coordinate your review without alerting the vendor Once sent, internal messages display a "Visible only to Your team" label so you can distinguish them from vendor-visible messages in the thread.
Who is included in "Your Team"? Your Team includes users in your organization who have been assigned one of the following roles: Admin, VRM (questionnaire sender), or the Review Questionnaires permission. Standard User-role accounts are not automatically included. To include a colleague with a User role, an Admin must grant them the Review Questionnaires permission individually.
The ability to send internal messages to Your Team is currently in Early Access. To turn this feature on for your individual organization, visit the Early Access Center.
Flag: Call the vendor's attention to a specific question if you have a concern or are not satisfied with their answer.
Findings: Create findings related to the vendor's response.
History: View a log of all changes and interactions associated with that question.
Once you have evaluated the vendor's response, you can finalize the question using either of the following methods:
To review and proceed immediately
Select Review and Next at the bottom of the page. This marks the current question as reviewed and automatically navigates you to the next question.To review without moving forward
Select Mark as reviewed to save your progress for the current question. When you are ready to continue, you can start your review from where you left off.
Finalize the review
Once you have finished reviewing all questions, you have two options to conclude the process:
Option 1: Send back for completion
If you are not satisfied with any of the vendor's responses or require additional information, select Send back.
Select the relevant reason(s) for the return (e.g., incomplete answers or missing attachments) and add a message in the text box to provide context and specific instructions for the vendor.
Select Send. The vendor will receive an email notification detailing your feedback.
Option 2: Finalize the questionnaire (Early Access)
This feature is currently in Early Access. Learn how to turn it on for your organization here.
If you are satisfied with the vendor's responses, you can close the review process by selecting Finalize questionnaire.
Here you can select your questionnaire decision (No decision, Passed, Passed with conditions, or Failed). Optionally, provide an explanation in the text box to document your internal reasoning.
Select Finalize to set the questionnaire's status to complete.
Understand and use validation scores
Validation scores help you prioritize your reviews by indicating how well a vendor's responses align with your organization's security requirements.
How to view the score
Go to Communication> Questionnaires > Outgoing and find the questionnaire you want to view. The validation score is visible in the questionnaire summary at the top of the page. Validation scores are displayed once the vendor completes 10% of the questionnaire.
Prioritizing reviews
As a best practice, prioritize reviewing questionnaires with lower validation scores. Please note that validation scores appear only after a vendor has completed at least 10% of the questionnaire, and they are available only on custom templates created via the Excel download/upload process.
How scores are calculated
The validation score is calculated by weighing responses based on the security controls defined in your template:
- Points: Responses indicating positive security controls increase the score, while negative responses do not (or decrease it).
- Percentage: The final score is displayed as a percentage of the total possible points.
-
Default scale: If you do not assign custom point values, the system applies the following default scale:
- Yes: +200 points
- N/A: +100 points
- No: 0 points
- Unanswered: 0 points
- Attachment provided: +50 points
You can set your own custom scores both at the Question and Response levels when creating custom questionnaires. For more information, see Build a customized questionnaire template.