---
sourceDocument: Australia Governance, Risk, and Compliance
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/governance-risk-compliance

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Governance, Risk, and Compliance

ft:clusterId :

    - grc

bundleId :

    - grc

workflow :

    - Technology


---

# Third-party portal contact roles and permissions

# Third-party portal contact roles and permissions {#ariaid-title1}

Release version: Australia  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 5 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Third-party portal contact roles and permissions

The third-party portal in ServiceNow uses a role-based access control system within the Smart Assessment Engine (SAE) to manage who can view, respond to, and administer questionnaire requests, issues, and tasks.
There are four defined contact roles, each with specific scopes and permissions to ensure appropriate access across entire third-party organizations or individual engagements.
This system supports organizations with multiple projects or business units by aligning responsibilities and visibility with the right team members.
Show full answer Show less  

## Contact Roles and Their Scopes

* **Third-party primary contact:** The main administrator for the third-party organization. They manage portal access, invite contacts, assign engagements, and coordinate questionnaire responses. Automatically assigned as questionnaire owner or contributor for third-party-level requests, but not automatically for engagement-level requests unless added. They can submit questionnaires and reassign ownership. Suitable for vendor relationship managers and portal administrators.
* **Third-party secondary contact:** A regular user with limited permissions. Not automatically assigned to questionnaires and must be added manually by the questionnaire owner. Can view and respond but cannot submit unless ownership is reassigned. Ideal for subject matter experts and technical staff.
* **Engagement primary contact:** Has administration privileges scoped to a single engagement. Automatically assigned as questionnaire owner or contributor for all questionnaires linked to their engagement. Cannot access requests outside their engagement. At least one engagement primary contact is required per engagement. Appropriate for project managers and service delivery leads.
* **Engagement secondary contact:** A team member with limited permissions scoped to a specific engagement. Must be manually added to questionnaires and can only be assigned within their engagement. Ownership reassignment grants full permissions. Suitable for individual contributors and consultants.

## Contact Routing for Element-Scoped Records

For assessments, issues, or tasks linked to multiple engagements, the system assigns the engagement primary contact alphabetically by last name from all linked engagements. At least one engagement primary contact must exist for submission. When resending assessments, the system routes to the previous handler if available; otherwise, it applies the standard routing rules. Reassignment and collaborator management for element-scoped records are limited to engagement primary contacts from linked engagements.

## Permissions Summary

The contact roles differ in capabilities such as inviting users, designating contacts, viewing questionnaire requests, automatic questionnaire assignment, submission rights, ownership reassignment, team membership management, deactivation rights, and access to multiple engagements. Key points include:

* Only third-party primary contacts can invite new users, designate other primary contacts, manage all engagements' team membership, and deactivate contacts.
* Engagement primary contacts have administrative permissions limited to their own engagements, including managing team membership and viewing engagement questionnaires.
* Primary contacts (third-party or engagement) are automatically added to questionnaires within their scope, while secondary contacts must be manually added.
* All roles can submit questionnaires if they are the questionnaire owner, and owners can reassign ownership and manage contributors.

## Practical Benefits for ServiceNow Customers

This role-based model enables precise control over portal access and questionnaire management, ensuring that the correct individuals engage with appropriate assessments. By differentiating between organization-wide and engagement-specific roles, customers can streamline collaboration, maintain security, and improve accountability across multiple projects or service lines within third-party organizations.  
The third-party portal uses a role-based access model to control who can view, respond to, and manage questionnaire requests, issues, and tasks. Each of the four contact role types has a defined scope and set of permissions.  
Important:  
This content describes contact roles and permissions in Smart Assessment Engine (SAE). The same four contact role types exist in both Smart and Classic engine, but their permissions differ due to different questionnaire assignment and submission models. In Classic, questionnaires are assigned to a single primary contact; in SAE, all primary contacts are automatically assigned and one is designated as the questionnaire owner. For information on the Classic assignment model, see [Managing the Third-party portal](https://www.servicenow.com/docs/0~pzVvr~IuJOCqkyFNmYfA "Third-party contacts respond to questionnaires, requests for documentation, tasks, and issues on the Third-party portal. The portal is the point of interaction between third parties and risk assessors.").

Third-party organizations may have multiple engagements with a customer---for example, different projects, services, or business units---and different team members may be responsible for responding to different questionnaire requests. The contact role system helps ensure that the right people have access to the correct information.

There are four contact role types in the third-party portal, organized by scope: third-party-level roles apply across the entire third-party organization, and engagement-level roles are scoped to a single engagement.

## Third-party primary contact {#tprm-portal-contact-roles__section_third_party_primary}

A third-party primary contact is the main administrator for the third-party organization in the portal. This role manages portal access for the third-party organization and can invite contacts, assign contacts to engagements, and coordinate questionnaire responses.

Third-party primary contacts are automatically added as the questionnaire owner or contributor to active third-party-level questionnaire requests. They are not automatically added to engagement-level questionnaire requests unless they are also added to the engagement or added to the questionnaire by the questionnaire owner.

When a third-party organization has multiple third-party primary contacts, the system selects one as the questionnaire owner based on alphabetical order by last name. The remaining primary contacts are added as questionnaire contributors. All primary contacts can view and respond to questions, but only the questionnaire owner can submit the completed questionnaire or reassign ownership.  
This role is appropriate for vendor relationship managers, compliance officers, executive sponsors, and portal administrators.  
Note:  
When you are designated as a third-party primary contact, the system automatically synchronizes you to existing third-party-level questionnaire requests. This synchronization occurs in the background. If you do not see questionnaire requests, refresh your browser or log out and log back in.

## Third-party secondary contact {#tprm-portal-contact-roles__section_third_party_secondary}

A third-party secondary contact is a regular user within the third-party organization with limited permissions. Unlike third-party primary contacts, secondary contacts are not automatically added to questionnaire requests. A questionnaire owner must explicitly add them using the Manage Contributors or Reassign actions.

When added to a questionnaire, third-party secondary contacts can view and respond to questions but cannot submit the questionnaire. If a questionnaire owner reassigns ownership to a third-party secondary contact, that contact gains full questionnaire owner permissions for that specific questionnaire.

This role is appropriate for subject matter experts, technical staff, and department representatives who respond to specific assessments.

## Engagement primary contact {#tprm-portal-contact-roles__section_engagement_primary}

An engagement primary contact has administrative privileges scoped to a single engagement. This role manages engagement-level access and questionnaire coordination for that engagement.

Engagement primary contacts are automatically added as the questionnaire owner or contributor to all questionnaire requests linked to their engagement. They cannot access questionnaire requests from other engagements or vendor-level questionnaire requests not tied to a specific engagement.  
Important:  
An engagement must have at least one engagement primary contact for questionnaire requests to be sent. Without an engagement primary contact, the system cannot assign a questionnaire owner for engagement-level assessments.

This role is appropriate for project managers, service delivery leads, and regional managers responsible for specific customer engagements.

## Engagement secondary contact {#tprm-portal-contact-roles__section_engagement_secondary}

An engagement secondary contact is a regular team member assigned to a specific engagement with limited permissions. Like third-party secondary contacts, engagement secondary contacts are not automatically added to questionnaire requests and must be manually added by the questionnaire owner.

Engagement secondary contacts can only be assigned to questionnaire requests within their specific engagement. If ownership is reassigned to an engagement secondary contact, that contact gains full questionnaire owner permissions for that specific questionnaire.

This role is appropriate for individual contributors, technical specialists, and consultants working on a particular engagement.

## Contact routing for element-scoped assessments, issues, and tasks {#tprm-portal-contact-roles__section_element_scoped_contact_routing}

A third-party element can be linked to multiple engagements. For an element-scoped assessment, issue, or task, contact routing considers the engagement primary contacts from all linked engagements, not just a single engagement.
The system collects the engagement primary contact from each linked engagement and assigns the contact whose last name appears first in alphabetical order. At least one linked engagement must have an engagement primary contact.
Otherwise, you receive the message "At least one primary contact must exist in the linked engagements for the element", and the assessment, issue, or task can't be submitted to the third party.

When you resend an assessment for the same element and questionnaire template, the system routes the assessment to the contact who handled the previous assessment for that template, provided that the contact is still active. If
that contact is no longer available, the system falls back to the current engagement primary contacts from the element's linked engagements and applies the standard routing logic. For element-scoped records, reassignment and
collaborator selection are also limited to engagement primary contacts from the element's linked engagements.

## Contact role permissions {#tprm-portal-contact-roles__section_role_permissions}

The following table summarizes the permissions available to each contact role type in Smart Assessment Engine (SAE) environments.
{#tprm-portal-contact-roles__table_contact_role_permissions__entry__5}

| Capability | Third-party primary | Third-party secondary | Engagement primary | Engagement secondary |
|-|-|-|-|-|
| Invite new users to portal | Yes | No | No | No |
| Designate third-party primary contacts | Yes | No | No | No |
| Designate engagement primary contacts | Yes | No | Yes (own engagement only) | No |
| View all third-party-level questionnaire requests | Yes | No | No | No |
| View all questionnaire requests for an engagement | No | No | Yes (own engagement only) | No |
| Automatically added to third-party-level questionnaire requests | Yes (as owner or contributor) | No | No | No |
| Automatically added to engagement questionnaire requests | No | No | Yes (own engagement only) | No |
| Submit questionnaire (only if questionnaire owner) | Yes | Yes | Yes | Yes |
| Reassign questionnaire ownership (if questionnaire owner) | Yes | Yes | Yes | Yes |
| Manage questionnaire contributors (if questionnaire owner) | Yes | Yes | Yes | Yes |
| Manage engagement team membership | Yes (all engagements) | No | Yes (own engagement only) | No |
| Deactivate contacts | Yes (third-party primary contact only) | No | No | No |
| Access multiple engagements | Yes (all) | No | Yes (assigned engagements only) | Yes (assigned engagements only) |
[Table 1. Contact role permissions comparison]

{#tprm-portal-contact-roles__table_contact_role_permissions}
**Related concepts**   

* [Managing the Third-party portal](https://www.servicenow.com/docs/0~pzVvr~IuJOCqkyFNmYfA "Third-party contacts respond to questionnaires, requests for documentation, tasks, and issues on the Third-party portal. The portal is the point of interaction between third parties and risk assessors.")
* [Questionnaire ownership and contributor access](https://www.servicenow.com/docs/kcSvQtyZtRVzjmKhXNz7KQ "Each Smart Assessment Engine questionnaire request in the third-party portal has a single questionnaire owner and can include questionnaire contributors. Ownership determines who can submit the completed questionnaire and who can manage team access.")  
**Related tasks**   

* [Manage questionnaire contributors and ownership](https://www.servicenow.com/docs/vs~LQiJBZ63GYYDnbBJ1nA "Add or remove contributors for a questionnaire request, or transfer questionnaire ownership to another contact, so the right team members can collaborate on and submit the questionnaire.")
* [Invite a contact to the third-party portal](https://www.servicenow.com/docs/MTupLYZ7Geh9gNPtF66euA "Invite a new team member to the third-party portal so they can access questionnaire requests, tasks, and issues for your organization.")
* [Assign a contact to an engagement](https://www.servicenow.com/docs/zYdD1KyoSUzE6KliDleh6Q "Add a contact from your third-party organization to a specific engagement team so they can access questionnaire requests for that engagement.")
* [Deactivate a third-party portal contact](https://www.servicenow.com/docs/IIS3~Nj8jRN2s515c0dK6g "Remove a contact's access to the third-party portal when they no longer need it, such as when a team member leaves the organization or changes roles.")
* [Manage access for your third-party contacts](https://www.servicenow.com/docs/hZK6yz8F3tL8vMgxJruiVQ "View your existing third-party contacts and adjust their information and access permissions as needed by using Third-party Risk Management. When you keep the contact details up to date, you can help to avoid your third-party contacts from getting unauthorized access or losing authorized access to the third-party portal.")