TRACK Program - Frequently Asked Question (FAQ)

The Agreement is between BlueVoyant, Auto-ISAC, the supplier, and the Original Equipment Manufacturer (OEM) accessing the supplier’s assessment. 

No, because the information that BlueVoyant would be providing as a risk finding is publicly available, and therefore, outside of the scope of confidentiality. An NDA will only be required for suppliers purchasing an assessment as suppliers would be providing information that would be considered confidential as part of that assessment.   

Yes, Suppliers will be able to download a copy via Shopify or the Questionnaire Platform. They can also view and download a copy via the landing page. 

Please visit this page here for guidance on logging into the platform. 

When you receive a TRACK assessment, you can easily view, manage, and answer your active assessments using our Assessments Module. For details on navigating to the Assessments Module visit the link here.

Please visit this page here to learn how to change assessment owners, invite new collaborators, and manage collaboration settings within active assessments. 

Yes, helpful platform instructions and detailed walkthroughs are available via the Help Center. The search feature can be used to readily identify key topics and platform functionality to support knowledge transfer.  

Please visit this page here to view Assessment Statuses. 

The TRACK Assessment Platform will generate automated emails which are distributed based upon defined rules. If clarifications are required as part of BlueVoyant’s technical analysis, any applicable follow-ups will be tied to specific questions and easily identified when accessing the platform to provide your responses. 

 Please visit this page here for guidance managing OEM access.

As a supplier, you can explicitly grant access to each participating OEM you are partnered with from within the portal, or share the resulting report other entities that you have deemed appropriate.  Please visit this page here for guidance managing OEM access.

Please visit this page here to attach and send additional evidence.  

A supplier only has the ability to modify or enhance their assessment performance during the clarification process. During this stage, a supplier will be able to address any requested clarifications provided by BlueVoyant’s technical analysts. By providing supplemental information / evidence to better achieve the control objective, a supplier is likely to improve their performance.  

When the TRACK Assessment is moved to the Completed stage, the BlueVoyant Risk Analyst assigned will generate the report and make it available for the evaluated Supplier. This deliverable can then be distributed to any number of OEMs approved by the Supplier by assigning it within the platform. 

Suppliers are encouraged to review issue records created and implement the associated recommendations and remit supporting evidences that can then be reviewed by BlueVoyant’s technical analysts to close out the issue(s).  

No, the final TRACK Assessment Report is a static (point-in-time) document which is not updated when an issue is remediated / closed. However, Suppliers are strongly encouraged to rapidly remediate any identified issues. A supplemental ‘Management Response’ addendum can be created on an ad hoc basis and presented along with your TRACK Assessment Report to show your efforts to close those issues identified. 

Yes, while a TRACK Assessment Report is valid for a two (2) year period, if a Supplier is looking to improve their score, they must pay for a new assessment.  

The TRACK Assessment is intended to take no longer than 30 days to perform, however, this timeframe can be impacted by several factors including the Supplier's performance of the assessment questions, quality of supporting evidence, and responsiveness to clarifications needed by the reviewing analyst. 

Yes. AI powered Smart Response is a generative AI solution integrated into the platform that transforms how you handle incoming assessments. This feature will significantly reduce the time spent on assessment responses as it automatically extracts answers from your existing documents (policies, reports, etc.) and previously completed assessments.

Please see a video demonstration of the Smart Response feature here.

Please see here for additional information on the platform’s AI capabilities. 

Once completed, the supplier will have TRACK verified status. This status is good for 2 years. At any point during this time, a supplier can update which OEM(s) have permission to view the supplier’s assessment results.  

Check out the platform Help Center. 

Continuous monitoring is an ongoing process of analyzing your organization's external digital presence to identify potential cybersecurity risks. Unlike a one-time assessment, it runs constantly — providing an up-to-date picture of your cyber risk posture. 

Your business partner has engaged BlueVoyant to help them understand cybersecurity risks across their vendor and supplier network. Your organization appears in their third-party ecosystem, which is why you're included in the monitoring program. 

BlueVoyant only looks at information that is already publicly visible on the internet. This includes: BlueVoyant only looks at information that is already publicly visible on the internet. This includes: 

BlueVoyant offers suppliers the ability to view their own findings through a dedicated supplier portal. This gives you direct visibility into what has been detected and what may need to be addressed. 

Access is typically initiated through the partner who has engaged BlueVoyant to monitor their third party's ecosystem.