RiskWatch Vendor Risk Management vs Smarsh Vendor Risk Management
RiskWatch Vendor Risk Management
riskwatch.comSmarsh Vendor Risk Management
smarsh.comSide by side
| Figure | RiskWatch Vendor Risk Management | Smarsh Vendor Risk Management |
|---|---|---|
| Price from | — | — |
| Free plan | — | — |
| Free trial | Yes | — |
| Open source | — | — |
| Web | Yes | Yes |
| iOS | Yes | — |
| Android | Yes | — |
| API | Yes | — |
| Self-hosted | Yes | — |
| Plans published | 3 | 3 |
| Spec score · Third-Party Risk Management Software | 7.8 (#6) | 6.6 (#25) |
| Founded | 1993 | 2001 |
| Headquarters | Sarasota, Florida, United States | Portland, Oregon, United States |
| Purpose | RiskWatch helps organizations identify, assess, monitor, and report risks introduced by vendors and other third parties. | Smarsh Vendor Risk Management automates and simplifies third-party risk evaluation and management to help organizations meet regulatory requirements and mitigate risk. |
| Security controls | The security page specifies TLS 1.3 in transit, AES-256 at rest, SAML 2.0 SSO, MFA, and role-based access controls. | Smarsh says its security model includes encryption in transit and at rest, single sign-on and multi-factor identification, vulnerability monitoring, and independent penetration testing. |
Plans
RiskWatch Vendor Risk Management
- EnterprisePriced on request
- GrowthPriced on request
- StarterPriced on request
Smarsh Vendor Risk Management
- ManagedPriced on request
- TechPriced on request
- Vendor Breach MonitoringPriced on request
In their own words
RiskWatch Vendor Risk Management
RiskWatch Vendor Risk Management helps organizations identify, assess, monitor, and report risks from vendors and other third parties. It assigns vendors to Tier 1, Tier 2, or Tier 3, then uses the tier to set questionnaire depth and reassessment cadence. Teams can use libraries covering SIG, CAIQ, and NIST 800-161 or upload custom questionnaires. Vendors respond through a portal, where they can complete questionnaires and attach SOC 2 reports; a parser extracts criteria, exceptions, CUECs, and gap findings from Type 1 and Type 2 reports and maps them to the customer's control library. Risk scoring covers eight categories, from cybersecurity and compliance to fourth-party risk. Monitoring integrations include BitSight, SecurityScorecard, sanctions watchlists, news feeds, and breach databases. Reports include vendor scorecards, portfolio rollups, and regulatory exam packs, with PDF and Excel exports. Mappings cover frameworks and regulations including ISO 27036, DORA, HIPAA, PCI DSS, and SOC 2. RiskWatch lists Android, iOS, API, self-hosted, and web platforms. Pricing is by request; a 7-day trial requires no credit card.
Smarsh Vendor Risk Management
Smarsh Vendor Risk Management has no write-up on Specifiction yet; its figures are above.