Yes, a manual process can work when the team can keep information current, protect it and follow through on decisions. A shared register, a controlled evidence folder and a reliable task or reminder system can be enough to start. The test is whether the work happens, not whether a dedicated platform has been purchased.
Keep one usable record for each service
Use a consistent record that links the vendor to the particular service and business owner. One company may supply several services with different risks. Avoid making a single “approved vendor” label cover uses nobody assessed.
- Use and impact: what the service does, relevant data or access, and why its failure matters.
- Evidence and judgment: links to reviewed material, review date, scope, important gaps and the decision.
- Actions: each concern, its owner, due date, status and evidence of resolution.
- Follow-through: next review, changes that trigger an earlier review, renewal and exit considerations.
These fields are a suggested starting point. Remove fields that nobody uses and add ones needed for your obligations. Keep confidential reports in appropriately restricted storage rather than attaching them to a widely shared tracker.
Run a complete cycle before adding complexity
Take one important service through intake, review, approval, an open issue and a follow-up. For example, if the vendor has not demonstrated a usable data export, record who will resolve that uncertainty and by when. Close the action only when the evidence answers it, or when an authorized person accepts the remaining limitation.
Set reminders that reach an accountable person. Have someone check overdue actions and owner changes. A register that still names a departed employee is not a functioning handoff.
Know when the manual process is struggling
Watch for signs that the manual process is struggling:
- Missed renewals or overdue actions.
- Conflicting versions or evidence nobody can find.
- Records that still name former owners.
- Issues closed without evidence or an approved risk decision.
First check whether responsibilities are unclear or the current system cannot handle the work. Software can help people coordinate. Someone still needs authority to make the decision.
NIST CSF 2.0 describes cybersecurity outcomes without prescribing how to achieve them. It does not establish a universal TPRM software requirement. Specific legal, regulatory or contractual obligations still need their own check.
Success looks like this: another reviewer can find the current decision, understand its basis, identify unresolved work and know what would cause the decision to change.
Explore the Third-party Risk guide for related questions and practical approaches.