Vendorapp › OpenVMO › OpenVMO in Vendorapp
Implementing OpenVMO with Vendorapp. What is covered, and what is not.
OpenVMO is vendor-neutral: every practice can be met with the free templates and no software at all. Vendorapp is one way to implement it. This page maps each OpenVMO practice to what Vendorapp does today, says plainly where coverage is partial, and points to the template to use where Vendorapp does not cover a practice.
Practice-by-practice mapping · Gaps stated plainly · Free plan available · Templates fill every gap
The mapping
OpenVMO practices in Vendorapp.
| Domain | Practices | In Vendorapp | Coverage |
|---|---|---|---|
| Governance | GOV-1 to GOV-6 | Contract owners and agent owners on every vendor. On Advanced and Expert, the compliance readiness hub records your policy link, approver and approval date, and keeps an annual review snapshot. | Partly covered |
| Inventory | INV-1, INV-2, INV-4 | One vendor register with domain, country, owner, status and criticality. Offboarded vendors are archived with the date and reason, not deleted. | Covered |
| Inventory | INV-3, INV-5 | There is no import from your finance ledger, card spend or single sign-on apps yet, so the discovery sweep and reconciliation are done with the template. | Use the template |
| Intake | INT-1 to INT-4 | Employee vendor requests on every plan, and a vendor is screened when it is added. Approval gates that scale with tier are not built in yet. | Partly covered |
| Tiering | TIER-1, TIER-2 | A criticality level per vendor, and a per-contract access risk assessment covering personal data, restricted data, customer-facing use and impact, which mirrors the OpenVMO rubric questions. | Covered |
| Due diligence | DD-1 | Sanctions screening against OFAC, UN, EU, UK and Australian lists when a vendor is added and when it is reassessed. | Covered |
| Due diligence | DD-2, DD-3, DD-5 | Inherent risk and ESG ratings from public information, a certificate vault with issuer, number and expiry, and AI-use detection on Advanced and Expert. There is no SOC 2 report review workflow or questionnaire exchange, so Tier 1 assurance review follows the template. | Partly covered |
| Contracts | CON-1 to CON-4 | A contract repository with AI-extracted dates, value, notice period, DPA status, breach-notification window and exit terms, plus renewal reminders and an expiry calendar. | Covered |
| Monitoring | MON-1 to MON-3 | Scheduled re-screening by criticality, sanctions alerts and a timeline per vendor. Assurance expiry is recorded in the certificate vault. | Covered |
| Monitoring | MON-4, MON-5 | Service-level reviews and a concentration view across critical services are run with the template. | Use the template |
| Fourth parties | FP-1 | On Expert, subprocessor detection reads each vendor’s published subprocessor list at screening time and records name, purpose and location, or that nothing is disclosed. | Covered |
| Fourth parties | FP-2 to FP-4 | Change notices, shared dependencies and full subcontracting chains are handled with the template. | Use the template |
| Incidents | INC-1 to INC-4 | Breach tracking per vendor with severity, evidence and escalation, and logged incident drills in the readiness hub on Advanced and Expert. | Covered |
| Offboarding | EXIT-1 | Cancel or close a contract with a reason, record when data deletion was requested and confirmed with evidence, and complete an offboarding checklist. | Covered |
| Offboarding | EXIT-2, EXIT-3 | Exit terms are captured on the contract, but there is no exit-plan record, so plans and tests follow the template. | Partly covered |
| Metrics | MET-1 to MET-3 | Reports on vendors, contracts and spend, and on Advanced and Expert a readiness board summary and PDF export for evidence packs. | Partly covered |
Some features depend on the plan: compliance readiness and AI-use detection are on Advanced and Expert, and subprocessor detection is on Expert. See pricing for the full list.
Evidence, not capability
Having the feature is not the same as doing the practice.
OpenVMO counts a practice as in place only when a dated record shows it was performed. Vendorapp creates many of those records as you work (screening dates, review dates, deletion confirmations), but a feature you have not used is not evidence. When you self-assess, check each practice against what has actually been done.
Vendorapp’s compliance readiness score is a separate measure aligned to NIS2 and DORA. It is not an OpenVMO self-assessment, and a strong readiness score does not by itself mean an OpenVMO level is reached.
Try it on your own vendors.
The free plan covers up to 15 vendors, enough to run Level 1 for a small company.