SecurityScorecard Cybersecurity Risk Insights App for Coupa

The SecurityScorecard Cybersecurity Risk Insights app for Coupa adds SecurityScorecard security ratings to your supplier records in Coupa. This article walks you through installing and configuring the app in Coupa R46 and later.

Before you begin

• You need administrator access to your Coupa instance.
• You need a SecurityScorecard API key. See Create API tokens for the SecurityScorecard platform.
• If your Coupa environment includes Coupa Risk and Performance Management (RPM) or RPM Advanced (RPMA), you can also send the SecurityScorecard score to the Supplier Risk Aware feed (step 5).

Step 1: Download the app

1. From the Coupa home page, click Community, then click App Marketplace.
2. Search for SecurityScorecard, then click the SecurityScorecard Cybersecurity Risk Insights tile.
3. Click Get Started.
4. Complete the App Marketplace form and click Install now.
   
5. Enter your Coupa instance URL (your_instance.coupahost.com) and click Continue. Coupa opens Community Exchange in your instance.
   
6. Coupa redirects you from the App Marketplace back to your Coupa environment. Click Download to place the app in your environment.

Step 2: Update the OAuth client and collect the identifier and secret

1. In Coupa, go to Setup > Integrations > OAuth2/OpenID Connect Clients.
2. Edit the OAuth Client for SecurityScorecard Connector client.
   
3. Set Client Purpose to App Marketplace Integration Partner.
4. At the bottom of the page, select You represent and warrant that all information you provide is accurate, complete, and current.
5. Click Save.
6. Click the OAuth Client for SecurityScorecard Connector name, then copy the Identifier and Secret. You use these values in step 4.
   

Step 3: Create custom fields on the supplier object

Important: The securityscorecard_domain and securityscorecard_monitored field names used in this step are required and must match exactly. The prompt and label text can be anything you choose.

1. In Coupa, go to Setup > Company Setup > Custom Fields.
2. Select the Suppliers object.

3. Create the SecurityScorecard Domain field with the following settings:

   • Field Name: securityscorecard_domain
   • Type: Text Field
   • Hint: Fill in this field only if auto-resolution failed or if you want to override the matched domain.

   

4. Create the SecurityScorecard Monitored field with the following settings:

   • Field Name: securityscorecard_monitored
   • Type: Check Box
   • Hint: When enabled, SecurityScorecard will monitor this supplier in accordance with your license entitlement.

   

Step 4: Configure the app properties

1. In Coupa, go to Setup > Platform > IFrames and Panels.
2. In the Actions column, turn on the SecurityScorecard Cybersecurity Risk Insights toggle to activate it.
   

3. Enter the following values:

   Field	Value
   Securityscorecard Apikey	Your SecurityScorecard API key. To get one, go to My Settings > API in the SecurityScorecard platform. For details, see Create API tokens for the SecurityScorecard platform.
   Securityscorecard Callout Uri	securityscorecard.datamap.ai
   Securityscorecard Callout Path1	api
   Securityscorecard Callout Path2	ScoreSyncV3
   Datamap App Code	GbUujK0npGgcYIbdt7D6n6lA4hbZTS9R2yXLagGAgMWlmY5ciA9jDdIDdS6zAM5886j0FVVVjKW8dZzipetpgCWKdwfcWKmNczoj
   Coupa Oauth Clientid	The OAuth2 identifier you copied in step 2.
   Coupa Oauth Client Secret	The OAuth2 secret you copied in step 2.
   Risk Custom Field Number 1 To 10	Enter N/A unless your Coupa environment includes RPM or RPMA. If it does, complete step 5 and enter the field number there.

4. Click Update.

Step 5: Configure a custom field for the Supplier Risk Aware feed (RPM and RPMA only)

Complete this step only if your Coupa environment includes RPM or RPMA. Without this field, you still get the SecurityScorecard panel on the supplier record, but the score does not appear in the Risk Aware feed.

1. In Coupa, go to Setup > Company Setup > Custom Fields.
2. Select the Supplier Risk Aware Feed object.

3. Select an inactive field, then set the following:

   • Prompt: SecurityScorecard Score
   • Hint: Higher is Better
   • Range: 1 to 100

   

4. Note the field number Coupa shows next to Originally Number field (for example, 03).
5. Go back to Setup > Platform > IFrames and Panels and open the Cybersecurity Risk Insights configuration.
6. Enter the field number (for example, 03) in Risk Custom Field Number 1 To 10, then click Update.
   

Verify your setup

After setup, you see the following in Coupa.

Enable monitoring on a supplier

Open a supplier record and select the SecurityScorecard Monitored check box. SecurityScorecard monitors the supplier according to your license entitlement.

View the SecurityScorecard panel

The SecurityScorecard Cybersecurity Risk Insights panel appears on the supplier record and displays the supplier's SecurityScorecard rating.

View scores in the Risk Aware feed (RPM and RPMA only)

If you completed step 5, open the Risk Aware menu item. Create a custom view that displays the SecurityScorecard score for your suppliers.

If the panel does not appear or the score is missing, confirm that the app slider is on, that the field names in step 3 match exactly, and that the API key and OAuth values are correct.

FAQ

Do I need a SecurityScorecard license? 

Yes, you need an active SecurityScorecard license to use this integration. Contact our Sales team for more information.