Trust Management Hub & Vendor Risk Management Data permissions by role and by action

Trust Management Hub and Vendor Risk Management hold third party risk management data, including artifacts, assignments, vendor connections, findings, reports, and security profiles. A user's Trust Management Hub or Vendor Risk Management role determines who can access and manage each type of data. For role descriptions, see Vendor Risk Management and Trust Management Hub user roles. This article lists the permissions for each role and for each action.

Roles referenced on this page: Users with the Admin, Group Admin, Portfolio Manager, Operations, Internal Business User, User, View Only, TMH Access Only Operations, Sales, or Sales Operations role.

What can my role do?

Use this section to find everything a specific role can and can't do with Trust Management Hub and Vendor Risk Management data. For a breakdown by action instead, see By action below.

By action

Permissions key

✅ = Is permitted.

❌ = Not permitted.

➖ = Not applicable and not permitted.

Download artifacts

✅ Admins, Operations, and View Only can do this.

✅ Internal Business Users can download artifacts of assigned vendors only.

➖ Not applicable to Group Admins, Portfolio Managers, and Users.

Good to know: artifacts are third party risk management documentation requested from the third party being assessed.
 

Assign tasks

✅ Admins and Operations can do this.

❌ Internal Business Users and View Only cannot do this.

➖ Not applicable to Group Admins, Portfolio Managers, and Users.
 

Edit assignments

✅ Admins and Operations can do this.

❌ Internal Business Users and View Only cannot do this.

➖ Not applicable to Group Admins, Portfolio Managers, and Users.
 

View tasks

✅ Admins and Operations can view all tasks.

✅ Internal Business Users and View Only can view owned tasks only.

➖ Not applicable to Group Admins, Portfolio Managers, and Users.
 

Access connections with 
vendors

✅ Admins, Operations, and View Only can do this.

✅ Internal Business Users can access connections for assigned vendors only.

➖ Not applicable to Group Admins, Portfolio Managers, and Users.
 

Request a connection with a 
vendor

✅ Admins and Operations can do this.

❌ Internal Business Users and View Only cannot do this.

➖ Not applicable to Group Admins, Portfolio Managers, and Users.
 

Edit company information

✅ Only Admins can do this.

❌ Internal Business Users, Operations, TMH Access Only Operations, and View Only cannot do this.

➖ Not applicable to Group Admins, Portfolio Managers, and Users.
 

Access the Executive 
Summary page

✅ Admins, Operations, and View Only can do this.

❌ Internal Business Users and TMH Access Only Operations cannot do this.

➖ Not applicable to Group Admins, Portfolio Managers, and Users.
 

View and use the TMH 
Dashboard

✅ Admins, Operations, and TMH Access Only Operations can do this.

❌ Internal Business Users and View Only cannot do this.

➖ Not applicable to Group Admins, Portfolio Managers, and Users.
 

Create findings

✅ Admins, Operations, and Internal Business Users can do this. [Confirm the Internal Business User scope.]

❌ View Only cannot do this.

➖ Not applicable to Group Admins, Portfolio Managers, and Users.

Good to know: findings are questions or concerns sent to the third party being assessed, including an expected remediation plan or outcome.
 

Generate the Findings 
Overview report

✅ Admins, Operations, and View Only can do this.

❌ Internal Business Users cannot do this.

➖ Not applicable to Group Admins, Portfolio Managers, and Users.

Good to know: the Findings Overview report summarizes the findings identified during vendor assessment.
 

View findings

✅ Admins, Operations, Internal Business Users, and View Only can do this. [Confirm the Internal Business User scope.]

➖ Not applicable to Group Admins, Portfolio Managers, and Users.
 

Generate the Risk 
Assessment Summary report

✅ Admins, Operations, and View Only can do this.

❌ Internal Business Users cannot do this.

➖ Not applicable to Group Admins, Portfolio Managers, and Users.

Good to know: the Risk Assessment Summary report shows a view of vendor security and risk posture.
 

Share your security profile

✅ Admins, Operations, Sales, Sales Operations, and View Only can do this.

➖ Not applicable to Internal Business Users, Group Admins, Portfolio Managers, and Users.