Inquiry response mapping for determining a cybersecurity risk level of an entity

A non-transitory computer-readable storage medium storing instructions that, when executed by one or more processors, cause the one or more processors to perform operations for providing a first questionnaire associated with vendor risk management of a first entity having a relationship with a second entity as a vendor of the first entity, the operations comprising:

• executing a first routine to receive a first questionnaire from the first entity for the second entity, the first entity different from the second entity, the first questionnaire including a first question associated with first question data;
• executing a second routine to perform a matching operation between the first question data and second question data associated with a second question of a second questionnaire, the second questionnaire corresponding to the second entity;
• based on a result of the matching operation indicating a match between the first question data and the second question data, executing a third routine to, generate a mapping between the first question and the second question;
• in response to identification of a response to the second question provided by the second entity, executing a fourth routine to populate, based on the match between the first question data and the second question data, the first questionnaire with the response to the second question as a response to the first question on behalf of the second entity;
• after population of the response to the first question with the response to the second question, determine a level of cybersecurity of the second entity for a cybersecurity category associated with the first question of the first questionnaire, the level of cybersecurity determined from at least one of a plurality of available levels, the plurality of available levels comprising a first level associated with low risk, a second level associated with medium risk, and a third level associated with high risk;
• and
• executing a fifth routine to provide, to the first entity, the first questionnaire including the first question populated with the response from the second question.

A system for providing a first questionnaire associated with vendor risk management of a first entity having a relationship with a second entity as a vendor of the first entity, the system comprising:

• a memory;
• and
• one or more processors coupled to the memory, the one or more processors configured to:
• receive a first questionnaire from the first entity for the second entity, the first entity different from the second entity, the first questionnaire including a first question associated with first question data;
• perform a matching operation between the first question data and second question data associated with a second question of a second questionnaire, the second questionnaire corresponding to the second entity;
• based on a result of the matching operation indicating a match between the first question data and the second question data, generate a mapping between the first question and the second question;
• in response to identification of a response to the second question provided by the second entity, populate, based on the match between the first question data and the second question data, the first questionnaire with the response to the second question as a response to the first question on behalf of the second entity;
• after population of the response to the first question with the response to the second question, determine a level of cybersecurity of the second entity for a cybersecurity category associated with the first question of the first questionnaire, the level of cybersecurity determined from at least one of a plurality of available levels, the plurality of available levels comprising a first level associated with low risk, a second level associated with medium risk, and a third level associated with high risk;
• and
• provide, to the first entity, the first questionnaire including the first question populated with the response from the second question.