> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coverbase.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Assessment quick reference

> A one-page cheat sheet for running a vendor risk assessment in Coverbase: five steps, tips, common scenarios, and troubleshooting.

<Info>
  This quick reference is part of the [User Guides](/user-guides/overview) collection. Keep it open in a tab while you work. For the screen-by-screen walkthrough, see [How to run an assessment](/user-guides/running-an-assessment). For the wider daily loop, see the [Analyst and reviewer guide](/user-guides/analyst-reviewer).
</Info>

## Creating and running an assessment

<Steps>
  <Step title="Initiate the assessment">
    Go to **Assessments → + New Assessment**, add the vendor (add several to start a batch), and pick the **Assessment Plan**. The plan carries the control sets and questionnaires, so that single choice is most of the setup. Check the summary under the dropdown before you continue, and don't leave it on **None**.
  </Step>

  <Step title="Get the evidence in">
    On the **Documents** tab, five routes combine freely: existing vendor docs, request from vendor (portal), request automatic collection, the Coverbase Library, and the vendor's trust center. Analysis starts on its own and runs 20 to 30 minutes on a heavy document set. The left panel tracks four stages: Collecting Documents, Analyzing Controls, Review Results, Quality Control.
  </Step>

  <Step title="Review the findings">
    You'll see passes (control met with evidence) and issues (gaps that need your review). Your job is to validate the AI's findings and review the flagged issues. Every result cites the source document and page, with the passage highlighted.
  </Step>

  <Step title="Address each issue">
    Review the evidence the AI found, then accept its assessment or override with your judgment. Use **Correct the AI** to fix a wrong result permanently, and **Preserve** to pin a result against future runs. Select rows for bulk **Accept risk**, **Add Finding**, or **Create follow-ups**. Add notes for the audit trail.
  </Step>

  <Step title="Generate follow-up questions">
    If needed, click Draft Follow-ups. The AI writes targeted questions for only the gaps. Saving creates a draft; the vendor sees nothing until the batch goes out through the portal. Only the followed-up controls are reanalyzed when they respond.
  </Step>

  <Step title="Final review and approval">
    Domain reviewers sign off (residual risk reads "Not set" until they do), then **Complete Assessment**: action, vendor status, next reassessment date, and recommendation. Export as PDF, Excel, CSV, or Word.
  </Step>
</Steps>

## Quick tips

<CardGroup cols={3}>
  <Card title="The AI does most of the work" icon="robot">
    It searches vendor websites, trust centers, and docs, pulls integrated data, and analyzes uploaded documents like SOC 2 reports and contracts.
  </Card>

  <Card title="You focus on judgment calls" icon="scale-balanced">
    Validate the AI's findings, review flagged issues, and override when the AI is wrong.
  </Card>

  <Card title="Speed matters" icon="gauge-high">
    Don't re-read what the AI already found. Focus on the yellow and red flags, and use bulk actions for similar issues.
  </Card>
</CardGroup>

<Tip>
  Trust the automation, verify the exceptions. Don't re-read what the AI already found. Spend your time on the flagged gaps.
</Tip>

## Common scenarios

<AccordionGroup>
  <Accordion title="Vendor has comprehensive security docs (ISO, SOC 2, etc.)" icon="file-shield" defaultOpen>
    Upload the documents during the assessment. The AI extracts the relevant controls, and most technical controls auto-pass based on the report, with exceptions flagged. You review any gaps.

    Typical time: 15 to 20 minutes.
  </Accordion>

  <Accordion title="Small vendor, limited docs" icon="file-circle-question">
    The AI searches public info, so more issues get flagged because there's less evidence. Generate a targeted questionnaire and let the vendor complete it through the portal.

    Typical time: 30 to 45 minutes, plus vendor response time.
  </Accordion>
</AccordionGroup>

## Troubleshooting

| Problem                                        | Solution                                                                                      |
| ---------------------------------------------- | --------------------------------------------------------------------------------------------- |
| AI missed obvious evidence                     | Upload the document and click Re-analyze                                                      |
| Too many questions generated                   | Review the control-set mapping, it may be too broad                                           |
| Vendor can't access the portal                 | Check email spam and resend the invitation                                                    |
| Wrong control set applied                      | Check the vendor's tags and adjust in the vendor profile                                      |
| Assessment stuck "In Progress"                 | Check whether a vendor questionnaire is still pending                                         |
| Assessment has no controls attached            | The plan was left on **None**. Pick a plan, or rerun with one                                 |
| **Complete Assessment** is greyed out          | Domain reviews aren't finished. Look at the review column, not the score                      |
| Residual risk reads "Not set"                  | That domain hasn't been reviewed yet. Someone needs to **Start review**                       |
| **Retrieve from Trust Center** isn't offered   | The vendor record has no Trust Center URL. Add it on the vendor, then retry                   |
| Assessments list looks empty                   | Clear the filters. An Assignee filter persists between visits                                 |
| "Unable to identify intake portal"             | Use your organization's intake link, found under **Intake → Request new vendor**              |
| Vendor wants to work in a spreadsheet          | Use **Download workbook** and **Import responses** on the Issues tab                          |
| Changed the plan and need everything re-scored | A follow-up only reanalyzes affected controls. Use rerun from the assessment **Actions** menu |

## Control frameworks at a glance

| Framework | What it covers                      |
| --------- | ----------------------------------- |
| NIST CSF  | Broad information security baseline |
| SIG Lite  | Standardized vendor questionnaire   |
| SOC 2     | Service organization controls       |
| ISO 27001 | International security standard     |
| GDPR      | EU data protection                  |
| PCI DSS   | Payment card security               |
| DORA      | EU financial services resilience    |

<Note>
  Your organization may have custom frameworks. Check **Configuration → Controls**.
</Note>

## Need help?

<CardGroup cols={3}>
  <Card title="Platform support" icon="envelope" href="mailto:support@coverbase.ai">
    [support@coverbase.ai](mailto:support@coverbase.ai)
  </Card>

  <Card title="Full walkthrough" icon="list-check" href="/user-guides/running-an-assessment">
    How to run an assessment, screen by screen.
  </Card>

  <Card title="The daily loop" icon="user-check" href="/user-guides/analyst-reviewer">
    The complete Analyst and reviewer guide.
  </Card>
</CardGroup>