--- sourceDocument: Australia Governance, Risk, and Compliance sourceDocumentLink: https://www.servicenow.com/docs/r/australia/governance-risk-compliance Release : - australia ft:locale : - en-US ft:publication_title : - Australia Governance, Risk, and Compliance ft:clusterId : - grc bundleId : - grc workflow : - Technology --- # Scores from risk intelligence providers # Integrating scores from risk intelligence providers {#ariaid-title1} Release version: Australia Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Integrating scores from risk intelligence providers ServiceNow enables organizations to integrate risk scores from various risk intelligence providers into their Third-Party Risk Management (TPRM) processes. These providers generate risk scores analogous to personal credit scores, offering insights into the trustworthiness and safety of third parties. Show full answer Show less This integration allows you to request risk data for third parties, register providers, specify the scoring services you use, and map their scores to your internal TPRM ratings. The system normalizes raw scores to standardize risk ratings, helping you assess and monitor third-party risks effectively. ## Key Features * **Provider Registration and Service Setup:** Create records for each risk intelligence provider and define which scoring or rating services to use and how to map their scores to your TPRM ratings. * **Request Types:** Define request types for each provider service to control the types of risk data requested for third parties. * **Score Normalization:** Add raw provider scores to third-party records, automatically normalizing them to your TPRM rating scale. * **Automated Actions:** Use provider-based submission rules to trigger actions (e.g., creating assessments, issues, tasks, or emails) when risk intelligence scores are updated. * **Integration Types:** Support for various integration types including Independent Software Vendor (ISV) services, content sources, data feeds, and Environmental, Social, and Governance (ESG) factors. * **Certified Integrations:** ServiceNow and its partners provide certified integrations with providers like EcoVadis, BitSight, Security Scorecard, Black Kite, and more, available via the ServiceNow Store. * **Custom Integrations:** Customers can build self-service custom integrations using Integration Hub following the registration and request-type patterns, though these are not certified or supported by ServiceNow. ## Key Outcomes * Streamlined incorporation of third-party risk intelligence into your TPRM workflows. * Improved risk visibility with normalized risk scores supporting consistent evaluations. * Automation of risk-related processes triggered by updated intelligence, enhancing response speed and reducing manual effort. * Access to a broad ecosystem of certified provider integrations covering cybersecurity, sustainability, compliance, ESG factors, and supply chain risk domains. * Flexibility to extend risk intelligence integration with custom providers to meet unique organizational needs. Risk intelligence providers generate risk scores for a variety of third-party risk domains. Your organization can purchase services from providers that return data that is analogous to personal credit scores. The scores provide insight on how trustworthy and safe a particular third party can be. ## Working with data from risk intelligence providers {#tprm-riskintelprvdr-overview__section_tq1_nzc_yxb} Note: You can request risk data for third parties but not for engagements. * After you register a risk intelligence provider, you specify which of the provider's scoring or rating services you'll use. You also specify how their scores or ratings map to your TPRM ratings. For more information, see [Register a risk intelligence provider](https://www.servicenow.com/docs/PoreWgmHfc1unv6j5xUMxA "Create a record for each risk intelligence provider from which you’ll request reports. The risk scores and ratings that risk intelligence providers generate are analogous to personal credit scores. The scores provide insight on how trustworthy and safe a particular third party can be."), [Set up a risk intelligence provider service](https://www.servicenow.com/docs/sxSJm02LQi7NqqaM0D0b4w "After you register a risk intelligence provider, you specify which of the provider's scoring or rating services you’ll use. You also specify how their scores or ratings map to your TPRM ratings."), and [Set up a request type for a provider](https://www.servicenow.com/docs/NNGNoIcJD4Ay_yuzmkgYKA "After you register a risk intelligence provider and service, you specify the available request types that you and your organization will use."). * You add a raw score from a provider to the provider service record for a third party. The system uses the mapping that you specified to normalize the value to the appropriate TPRM rating. For more information, see [Add a risk intelligence score to risk data for a third party](https://www.servicenow.com/docs/NhS7YKe29kmpHbuOkYaSSw "You add a raw score from a provider to the provider service record for a third party. The system uses the mapping that you specified to normalize the value to the appropriate TPRM rating."). * A provider-based submission rule is a set of conditions and actions. In a rule, you can specify that an update to a rating from a risk intelligence provider is the condition that triggers the action that is specified in the rule. The action might be to create and send a third-party risk assessment, issue, task, or email. For more information, see [Automate actions upon risk intelligence updates](https://www.servicenow.com/docs/3USbBkIOTGM6sGTmx3l2YQ "A provider-based submission rule is a set of conditions and actions. In a rule, you can specify that an update to a rating from a risk intelligence provider is the condition that triggers the action that is specified in the rule. The action might be to create and send a third-party risk assessment, issue, task, or email."). {#tprm-riskintelprvdr-overview__ul_i5w_k1d_yxb} ## Integration types {#tprm-riskintelprvdr-overview__section_mmd_kkf_3bc} Here are some examples of the types of integrations supported by ServiceNow and ServiceNow partners: Note: The tables in the following sections list the complete, current set of ServiceNow certified risk intelligence integrations. If a provider doesn't appear in either table, no packaged integration currently exists for it. * Independent software vendor (ISV) integration types involve integrating ISV services such as EcoVadis or Black Kite. * Content integration types involve integrating external content sources such as regulatory databases or industry standards. * Data integration types involve integrating external data sources to gather and analyze relevant data such as data from financial systems, security tools, or vendor management systems. * Environmental, social, and governance (ESG) integration types involve incorporating ESG factors into the TPRM process. {#tprm-riskintelprvdr-overview__ul_yfd_w3f_3bc} ## Integrations supported by ServiceNow {#tprm-riskintelprvdr-overview__section_z52_dnx_hyb} Note: You can find the integration apps on the ServiceNow Store. {#tprm-riskintelprvdr-overview__table_wlb_wrx_hyb__entry__5} | Provider | Product name | Content | Service provided | Type | |-|-|-|-|-| | Shared Assessments | Standard information-gathering (SIG) questionnaire | Standard assessment | Industry standard questionnaire for use in assessments. | Content | | EcoVadis | EcoVadis | Sustainability ratings | Sustainability scores in support of assessments and continuous monitoring. | ISV, data, ESG | [Table 1. Integrations supported by ServiceNow] {#tprm-riskintelprvdr-overview__table_wlb_wrx_hyb} ## Integrations supported by ServiceNow partners {#tprm-riskintelprvdr-overview__id_k51_fnx_hyb} Note: You can find the integration apps on the ServiceNow Store. {#tprm-riskintelprvdr-overview__table_pvx_wsx_hyb__entry__5} | Provider | Product name | Content | Use case | Type | |-|-|-|-|-| | BitSight | BitSight | Cyber risk ratings | Cyber risk scores in support of assessments and continuous third-party risk monitoring. | ISV, data | | Security Scorecard | Security Scorecard | Cyber risk ratings | Cyber risk scores in support of assessments and continuous third-party risk monitoring. | ISV, data | | RiskRecon | Risk Recon | Cyber risk ratings | Cyber risk scores in support of assessments and continuous third-party risk monitoring. | ISV, data | | Upguard | Upguard Vendor Risk | Cyber risk | Cyber risk scores in support of assessments and continuous third-party risk monitoring. | ISV, data | | Recorded Future | Recorded Future Intelligence | Cyber risk ratings | Cyber risk scores in support of assessments and continuous third-party risk monitoring. | ISV, data | | Black Kite | Black Kite | Third-party risk management | Technical security, financial risk, ransomware susceptibility index, and compliance scores in addition to overall security ratings. | ISV | | Interos | Interos | Supply chain and multiple domain ratings | Cyber, financial, ESG, geopolitical, operations, and restrictions ratings to support risk assessments and monitoring. | ISV, content | | TruSight | TruSight | Third-party risk assessments | Access to TruSight-validated third-party risk assessments. | ISV | | ISS Corporate Solutions | ISS ESG Cyber Risk Score for Vendor Risk Management | ESG ratings | Access to a comprehensive view of ISS Corporate Solutions' cyber risk management program through cyber risk and supply chain. | ISV | | Securitybricks | CMMC - NIST-800-171 - Vendor Compliance Assessment | Template | Access to an automated assessment for Federal organizations. | data, content | | Templarshield | HECVAT-Questionnaire for Higher Education | Content | Access to an automated questionnaire for Higher education organizations. | ISV, content | [Table 2. Integrations supported by partners] {#tprm-riskintelprvdr-overview__table_pvx_wsx_hyb} Note: You can build a custom integration to any risk data provider using Integration Hub and the same registration and request-type pattern described in [Register a risk intelligence provider](https://www.servicenow.com/docs/PoreWgmHfc1unv6j5xUMxA "Create a record for each risk intelligence provider from which you’ll request reports. The risk scores and ratings that risk intelligence providers generate are analogous to personal credit scores. The scores provide insight on how trustworthy and safe a particular third party can be.") and [Set up a risk intelligence provider service](https://www.servicenow.com/docs/sxSJm02LQi7NqqaM0D0b4w "After you register a risk intelligence provider, you specify which of the provider's scoring or rating services you’ll use. You also specify how their scores or ratings map to your TPRM ratings."). This is a self-service integration that ServiceNow doesn't certify or support. * **[Register a risk intelligence provider](https://www.servicenow.com/docs/PoreWgmHfc1unv6j5xUMxA)** Create a record for each risk intelligence provider from which you'll request reports. The risk scores and ratings that risk intelligence providers generate are analogous to personal credit scores. The scores provide insight on how trustworthy and safe a particular third party can be. * **[Set up a risk intelligence provider service](https://www.servicenow.com/docs/sxSJm02LQi7NqqaM0D0b4w)** After you register a risk intelligence provider, you specify which of the provider's scoring or rating services you'll use. You also specify how their scores or ratings map to your TPRM ratings. * **[Set up a request type for a provider](https://www.servicenow.com/docs/NNGNoIcJD4Ay_yuzmkgYKA)** After you register a risk intelligence provider and service, you specify the available request types that you and your organization will use. * **[Add a risk intelligence score to risk data for a third party](https://www.servicenow.com/docs/NhS7YKe29kmpHbuOkYaSSw)** You add a raw score from a provider to the provider service record for a third party. The system uses the mapping that you specified to normalize the value to the appropriate TPRM rating. * **[Automate actions upon risk intelligence updates](https://www.servicenow.com/docs/3USbBkIOTGM6sGTmx3l2YQ)** A provider-based submission rule is a set of conditions and actions. In a rule, you can specify that an update to a rating from a risk intelligence provider is the condition that triggers the action that is specified in the rule. The action might be to create and send a third-party risk assessment, issue, task, or email. **Related tasks** * [Register a risk intelligence provider](https://www.servicenow.com/docs/PoreWgmHfc1unv6j5xUMxA "Create a record for each risk intelligence provider from which you’ll request reports. The risk scores and ratings that risk intelligence providers generate are analogous to personal credit scores. The scores provide insight on how trustworthy and safe a particular third party can be.") * [Set up a risk intelligence provider service](https://www.servicenow.com/docs/sxSJm02LQi7NqqaM0D0b4w "After you register a risk intelligence provider, you specify which of the provider's scoring or rating services you’ll use. You also specify how their scores or ratings map to your TPRM ratings.") * [Set up a request type for a provider](https://www.servicenow.com/docs/NNGNoIcJD4Ay_yuzmkgYKA "After you register a risk intelligence provider and service, you specify the available request types that you and your organization will use.") **Related reference** * [Viewing risk intelligence scores](https://www.servicenow.com/docs/dB9I4EN6DLOCjlFRsP2RvQ "For DD requests, risk intelligence scores appear in a list. For an individual third party, a card displays the most recent score or rating and a link for each risk intelligence report.")