Platform Documentation

Platform Overview

Fair TPRM is a unified platform built around two integrated modules:

• TPRM Module — Third-Party Risk Management for tracking, assessing, and scoring vendor relationships throughout their entire lifecycle.
• GRC Module — Governance, Risk & Compliance for managing your organization’s compliance posture across multiple industry frameworks including SOC 2, ISO 27001, PCI DSS, NIST CSF, CMMC, HIPAA, CIS Controls, NIST 800-171, and the NIST AI Risk Management Framework.

Both modules share the same database, the same permission model, and the same audit log — eliminating data silos and duplicate work.

Navigating the Sidebar

The application sidebar is your primary navigation tool. It is organized as follows:

1. At the top of the sidebar you will see your company logo (configurable in Admin → Branding).
2. Below the logo are two collapsible module headers: TPRM Module and GRC Module. Click either header to expand or collapse its sections.
3. Inside each module header you will find collapsible sections that group related pages together.
4. At the bottom of the sidebar are utility links for your profile, notifications, and logout.

GRC Module Sidebar Sections

User Roles & Permissions

Fair TPRM uses role-based access control (RBAC) with seven default ACL groups. Each user is assigned to one or more groups that determine which modules and actions they can access.

Your First Login

1. Open your browser and navigate to your organization’s Fair TPRM URL (provided by your administrator).
2. Enter your Username and Password on the login screen.
3. If TOTP two-factor authentication is enabled for your account, enter the six-digit code from your authenticator app.
4. After successful authentication you will land on the Dashboard page.
5. In the sidebar, click GRC Module to expand its sections and begin working with compliance features.

What’s New in Version 2.6.1

Version 2.6.1 adds several features focused on vendor onboarding, procurement collaboration, multi-language support, and shadow-SaaS discovery. If you have used an earlier version (2.5.8), here is what is new. Each item links to its full walkthrough later in this guide.

GRC Module Overview

GRC stands for Governance, Risk & Compliance. The GRC module helps your organization:

• Assess security maturity across 14 domains using the unified questionnaire
• Track compliance posture against 9 industry frameworks simultaneously
• Manage internal controls and map them to framework requirements
• Collect and encrypt compliance evidence with expiry tracking
• Manage policies through their full lifecycle from draft to retirement
• Plan and execute audits with finding tracking and remediation
• Maintain a risk register with likelihood and impact scoring
• Run continuous monitors to demonstrate ongoing compliance

Getting Started with GRC — Quick Start

Follow this five-step workflow to complete your first GRC compliance assessment:

1. Create an Assessment — Define the scope and select the assessment type.
2. Answer Questions — Work through the 170+ unified questions across 14 security domains.
3. Upload Evidence — Attach supporting documents and artifacts to your responses.
4. View Compliance Scores — Review automatically calculated compliance percentages for each framework.
5. Generate Reports — Export framework-specific compliance reports for stakeholders and auditors.

Step 1: Create Your First Assessment

1. In the sidebar, expand GRC Module → Assessment & Audit → click Assessment Questionnaire.
2. Click the Create Assessment button.
3. Fill in the required fields:

• Title — A descriptive name for the assessment (e.g., “Q1 2026 Annual Compliance Assessment”).
• Assessment Type — Choose from five options: Initial Assessment, Annual Review, Gap Analysis, Remediation Validation, or Ad-Hoc Assessment.
• Scope — Describe what the assessment covers (e.g., “Enterprise-wide security posture”).
• Lead Auditor — Select the user who will lead the assessment.
• Start Date and End Date — Define the assessment period.

Assessment Statuses

Step 2: Answer Assessment Questions

The unified assessment contains 170+ questions organized across the following 14 security domains:

Answering a Question

1. Open the assessment and select a domain to begin answering questions.
2. For each question, select a Maturity Rating from the four-tier scale:

• 1 — Initial / Ad Hoc: Processes are reactive, undocumented, and inconsistently applied.
• 2 — Developing: Processes are partially documented but not consistently followed.
• 3 — Defined: Processes are fully documented and consistently implemented across the organization.
• 4 — Managed / Optimized: Processes are measured, continuously improved, and aligned with industry best practices.

Conformity Status

Based on the maturity rating you select, the system determines a Conformity Status for each mapped framework requirement:

• Conforming — The requirement is fully met (typically maturity 3 or 4).
• Partial — The requirement is partially met (typically maturity 2).
• Non-Conforming — The requirement is not met (typically maturity 1).
• Not Applicable — The requirement does not apply to your organization’s scope.

Step 3: Upload Evidence

Evidence files support your assessment responses and demonstrate compliance to auditors.

1. While answering a question, click the Attach Evidence button next to the question.
2. Select a file from your computer (supported formats include PDF, images, and documents).
3. Add a Description and set the Expiry Date for the evidence.
4. Click Upload to attach the evidence to the question.

Evidence Library

All uploaded evidence is also accessible from the Evidence Library (sidebar → GRC Module → Evidence & Monitoring → Evidence Library). The library provides a centralized view of all evidence across the platform, with filtering by status, expiry date, and linked control or question.

Step 4: View Compliance Scores

1. Navigate to GRC Module → Compliance → Dashboard.
2. The dashboard displays a card for each supported framework showing a donut chart with the current compliance percentage.
3. Click any framework card to drill into its detailed compliance report.

Compliance Formula

Requirements marked as “Not Applicable” are excluded from the denominator, ensuring your score reflects only relevant requirements.

Supported Frameworks

Step 5: Generate a Framework Compliance Report

1. From the Compliance Dashboard, click the framework card you want to report on.
2. Click the Generate Report button at the top of the framework detail page.
3. The report is generated and displayed in-browser. Use the Export PDF button to download a copy.

What Each Requirement Card Shows

The compliance report lists every requirement for the selected framework. Each requirement card displays:

• Reference — The framework requirement identifier (e.g., CC6.1 for SOC 2, A.8.2 for ISO 27001).
• Title — The requirement name or description.
• Status Badge — Conforming, Partial, Non-Conforming, or Not Applicable.
• Mapped Questions — Each linked unified question showing its maturity rating, conformity status, validation notes, and attached evidence.

CSF Maturity Score Dashboard

1. In the sidebar, navigate to GRC Module → Assessment & Audit → CSF Maturity Score.
2. Select an assessment from the dropdown to view its maturity scoring.

The CSF Maturity Score dashboard displays:

• Overall FAIR Score — A single weighted score (1.0–4.0) representing your organization’s overall security maturity.
• Radar Chart — A visual comparison of maturity scores across all 14 security domains.
• Domain Score Cards — Individual maturity scores for each of the 14 domains with color-coded tier indicators.
• Framework Compliance Bars — Horizontal bar charts showing compliance percentages for each supported framework.
• Gap Analysis Summary — A breakdown of domains where maturity falls below your target threshold, with recommendations for improvement.

Frameworks Page

1. Navigate to GRC Module → Compliance → Frameworks.
2. Select a framework from the list to view its requirement tree.

The Frameworks page displays the full requirement hierarchy for each supported framework. Requirements are organized in a tree view with expandable sections, domains, and individual requirements. Each requirement shows its conformity status and linked assessment questions.

Internal Controls

Internal controls document the security measures your organization has in place. Controls can be mapped to requirements across multiple frameworks simultaneously.

1. Navigate to GRC Module → Compliance → Controls.
2. Click Add Control to create a new control.
3. Fill in the control details:

• Title — A descriptive name for the control.
• Description — What the control does and how it is implemented.
• Type — Preventive, Detective, or Corrective.
• Category — Technical, Administrative, or Physical.
• Status — Not Implemented, Partially Implemented, or Fully Implemented.
• Effectiveness — Effective, Partially Effective, or Ineffective.
• Risk Level — Low, Medium, High, or Critical.
• Owner — The user responsible for maintaining this control.
• Test Frequency — How often the control is tested (e.g., Monthly, Quarterly, Annually).
• Framework Mapping — Select which framework requirements this control satisfies.

Framework Crosswalk

The crosswalk tool lets you compare coverage between any two supported frameworks to identify gaps and overlaps.

1. Navigate to GRC Module → Compliance → Crosswalk.
2. Select a Source Framework from the first dropdown (e.g., SOC 2).
3. Select a Target Framework from the second dropdown (e.g., ISO 27001).
4. The crosswalk displays a side-by-side mapping showing which source requirements map to target requirements, and highlights any gaps where the target framework has requirements not covered by the source.

Evidence Library

The Evidence Library provides a centralized view of all compliance evidence uploaded across the platform.

1. Navigate to GRC Module → Evidence & Monitoring → Evidence Library.
2. Click Upload Evidence to add a new evidence file.
3. Fill in the Title, Description, Expiry Date, and optionally link the evidence to a control or assessment question.
4. Select the file and click Upload.

Evidence Statuses

Policy Management

The Policy Management feature lets you create, review, approve, and publish organizational policies with version tracking and periodic review scheduling.

1. Navigate to GRC Module → Policy Management → Policies.
2. Click Create Policy to add a new policy.
3. Fill in the policy details:

• Title — The policy name (e.g., “Acceptable Use Policy”).
• Category — The policy category (e.g., Information Security, Access Control, Data Privacy).
• Review Frequency — How often the policy should be reviewed (e.g., Annually, Semi-Annually).
• Content — The full policy text, entered in the rich text editor.

Policy Lifecycle

Draft → Review → Approved → Published → Retired

Audits & Findings

The Audits feature supports your internal and external audit processes from planning through remediation and closure.

1. Navigate to GRC Module → Assessment & Audit → Audits.
2. Click Create Audit to start a new audit.
3. Define the audit scope, assign the audit lead, and set the timeline.
4. During fieldwork, record findings using the Add Finding button. Each finding includes a title, description, severity rating, affected control, and recommended remediation.
5. Assign remediation tasks to responsible parties and track progress through to closure.

Audit Statuses

Risk Register

The Risk Register tracks organizational risks with quantified likelihood and impact scoring.

1. Navigate to GRC Module → Assessment & Audit → Risk Register.
2. Click Add Risk to create a new risk entry.
3. Fill in the risk details:

• Title — A concise name for the risk.
• Description — A detailed description of the risk scenario.
• Category — The risk category (e.g., Operational, Technical, Compliance, Strategic).
• Likelihood — Probability of occurrence on a 1–5 scale.
• Impact — Severity of consequences on a 1–5 scale.
• Treatment Strategy — Accept, Mitigate, Transfer, or Avoid.

The Inherent Risk Score is calculated as Likelihood × Impact (range 1–25) before controls are applied. The Residual Risk Score is recalculated after treatment controls are linked, reflecting the remaining risk after mitigation measures are in place.

Continuous Monitors

Continuous monitors run automated compliance checks on a scheduled basis to demonstrate ongoing compliance to auditors.

1. Navigate to GRC Module → Evidence & Monitoring → Continuous Monitors.
2. Click Create Monitor to define a new monitor.
3. Fill in the monitor details:

• Title — A descriptive name for the monitor.
• Check Type — The type of check to perform (e.g., Certificate Expiry, DNS Configuration, Policy Review Due).
• Frequency — How often the monitor runs (Hourly, Daily, Weekly, or Monthly).
• Collector Configuration — The technical configuration for the data collection method, including target endpoints and thresholds.

Task Inbox

The Task Inbox shows all GRC tasks assigned to the currently logged-in user. Tasks are generated when assessment questions or remediation items are delegated to you.

1. Navigate to GRC Module → Assessment & Audit → Task Inbox.
2. Review your assigned tasks, which include the task type, due date, and priority.
3. Click a task to open it, complete the required action (answer a question, upload evidence, or confirm remediation), and mark it as done.

GRC Dashboard

The GRC Dashboard provides a single-pane-of-glass view across your entire compliance program. It displays:

• Framework Compliance Heatmap — Color-coded compliance scores for all 9 frameworks at a glance.
• Control Implementation Progress — Percentage of controls that are fully implemented, partially implemented, and not implemented.
• Evidence Freshness — Visual indicator of how many evidence items are current, approaching expiry, or expired.
• Open Findings — Count of unresolved audit findings grouped by severity (Critical, High, Medium, Low).
• Policy Review Status — Policies due for review, overdue, and recently reviewed.
• Monitor Health — Pass/fail status of all continuous monitors with trend indicators.
• Risk Register Summary — Distribution of risks by treatment strategy and current risk levels.

TPRM Module Overview

The TPRM (Third-Party Risk Management) module provides end-to-end vendor risk management. It allows you to track and assess vendors, assign risk tiers, send security assessments, perform FAIR risk quantification, monitor 4th party dependencies, and discover Shadow SaaS applications across your organization.

For detailed information about TPRM capabilities, visit the Vendor Lifecycle and FAIR Analysis pages.

Adding a New Vendor

To add a vendor, navigate to the TPRM Module in the sidebar and click Add Vendor. Complete the required fields including Vendor Name, Domain, Type, Tier, contact information, and data handling details such as PII Count and SPII Count (the number of personally identifiable and sensitive personally identifiable information records the vendor will access).

Vendor Lifecycle

Every vendor follows a defined lifecycle from initial request through offboarding. The status flow is:

Draft → Pending Review → In Review → Approved / Rejected → Active → Annual Review → Offboarded

Each transition is logged in the audit trail, and automated notifications can be configured for status changes. See the Vendor Lifecycle page for full details.

Vendor Assessments

Security assessments can be sent directly to vendors through the platform. The vendor receives an email with a secure link to complete the questionnaire. Responses are automatically scored and integrated into the vendor’s risk profile. Assessments can be customized by tier, and follow-up assessments can be triggered based on scoring results.

Security Risk Scorecard (SRS)

The SRS provides an external security score for each vendor based on automated scanning of their public-facing infrastructure. Scoring categories include DNS configuration, SSL/TLS certificate health, email security (SPF, DKIM, DMARC), and open port exposure. Signal weights are fully configurable by administrators. See the Monitoring page for details.

FAIR Analysis

Fair TPRM implements the FAIR (Factor Analysis of Information Risk) quantitative risk model to estimate the financial impact of vendor-related security incidents. The analysis produces an Annualized Loss Expectancy (ALE) and recommended cyber insurance coverage. All multipliers and thresholds are configurable. Visit the FAIR Analysis page for a complete overview.

4th Party Risk

Fourth-party risk tracking lets you identify and monitor your vendors’ vendors — the downstream dependencies that could affect your organization. The platform maps these sub-service relationships and flags concentration risk when multiple vendors rely on the same fourth party.

Shadow SaaS Discovery

Shadow SaaS discovery identifies unapproved SaaS applications in use across your organization. The feature detects cloud services that have not been formally onboarded through the TPRM process, enabling your security team to assess risk, enforce governance, and bring shadow applications under management. In v2.6.1, discovery can be automated with the Grip Security integration, and unsanctioned apps can be blocked through Zscaler.

General Settings

The General Settings page (Admin → Settings → General) allows administrators to configure core platform settings including the Application Name, Company Name, and Support Email address. These values appear throughout the platform interface and in system-generated emails.

Branding & Theme

Customize the platform’s appearance from Admin → Settings → Branding. Upload your organization’s logo, set primary and accent colors, and adjust the sidebar navigation width. Branding changes take effect immediately for all users.

User Management

Manage user accounts from Admin → Users. Administrators can create new users, assign them to one or more ACL groups, enable or disable TOTP two-factor authentication, and deactivate accounts. Group membership determines which modules and actions each user can access.

1. Navigate to Admin → Users.
2. Click a user to edit, or click Add User to create a new account.
3. In the ACL Groups section, check the groups this user should belong to.
4. Click Save to apply changes.

Email Configuration

Configure outbound email from Admin → Settings → Email. Enter your SMTP server details including host, port, encryption method (TLS/SSL), username, and password. The platform uses email for vendor assessment invitations, task notifications, password resets, and audit reminders.

SAML / SSO

Fair TPRM supports SAML 2.0 single sign-on for enterprise identity providers. Configure SSO from Admin → Settings → SAML. You will need to provide the IdP Entity ID, SSO URL, SLO URL, and X.509 certificate from your identity provider. SCIM 2.0 provisioning is also supported for automated user lifecycle management.

AI Integration

Fair TPRM offers optional AI-powered features for generating executive risk summaries, suggesting control descriptions, and analyzing assessment gaps. Configure AI integration from Admin → Settings → AI. The platform supports integration with compatible AI services, and all AI features can be enabled or disabled individually.

Recommended: Self-Host OpenWebUI or LibreChat

For full control over your AI integration, we recommend self-hosting OpenWebUI or LibreChat alongside Fair TPRM. Both are free, open-source AI front-ends that run as a single Docker container and are compatible with Fair TPRM’s AI integration settings.

Setup overview:

1. Deploy OpenWebUI or LibreChat — Run the Docker image on the same server as Fair TPRM or on a separate host. Both support Docker Compose for easy deployment.
2. Configure an LLM provider — Connect to OpenAI, Anthropic, a local Ollama instance, or any OpenAI-compatible API endpoint.
3. Point Fair TPRM to your AI service — In Admin → Settings → AI, enter the URL of your self-hosted AI instance and your API key.
4. Enable AI features — Toggle individual AI capabilities: executive summaries, control suggestions, and gap analysis.

Cost: $0 for self-hosted OpenWebUI or LibreChat. If using a cloud LLM provider, costs depend on your API usage (typically a few dollars per month for moderate use). Fully local models via Ollama are completely free.

Security Rating Services: Shodan API

For continuous external security scoring, Fair TPRM integrates with the Shodan API. A Shodan membership (approximately $59/month) gives Fair TPRM automated Security Rating Scores for your entire vendor portfolio — including TLS analysis, CVE detection, network security, and application hardening.

Configure the Shodan API key in Admin → Settings → SRS. Shodan is automatically provisioned for free during the hosted demo.

Glossary