This guide provides instructions for submitting and tracking risk reviews in LogicGate. Requestors can access the risk review process through the Wharton ISO website.
Before starting a request, determine whether you need a Vendor Review or an Initiative Review:
Vendor Review: Use this process when evaluating a third-party vendor, product, or service. The Vendor Review workflow in LogicGate is managed by Penn. Wharton ISO participates as the designated reviewer for vendors identified as supporting Wharton.
Initiative Review: Use this process when evaluating a new or significantly changed technology, system, project, initiative, interconnection, or integration.
If you are unsure which process to use, contact the Wharton Information Security Office at security@wharton.upenn.edu.
Vendor Review
Penn has established the vendor review process (called TPRM – Third-Party Risk Management) in LogicGate as the University-wide workflow for evaluating third-party vendors, products, and services.
The vendor review form and workflow are managed by Penn, not Wharton. When a vendor is identified as being used for Wharton, Wharton ISO is assigned as the designated reviewer.
Because this is a Penn-managed process, the questions, form structure, and workflow may differ from Wharton’s previous vendor review process.
When to Submit a Vendor Review
Submit a vendor review when you are considering a new vendor, product, or service, or when an existing vendor relationship changes in a way that may affect risk.
Examples include:
Purchasing or adopting a new SaaS product
Engaging a new third-party service provider
Renewing or materially changing an existing vendor relationship
Starting a Vendor Review
Go to the Wharton ISO website and click the Vendor Review button under "Submit a Risk Review."
Log in to LogicGate using your PennKey SSO credentials.
From the home screen, search the All Third Parties table to determine whether the vendor already exists.
If the vendor does not already exist, select the blue Create Record button in the upper-right corner of the home screen.
Select Add Third Party, then select Create.
Complete the Third-Party Details, Third-Party Contact, and The University of Pennsylvania Relationship Owner Information sections.
Under the Relationship Owner section, select Wharton School from the drop-down list for Organization.
For a new vendor or product, select + Create New Product and enter the requested product details.
Select Submit to create the Product record.
Confirm that the Product is linked to the Third-Party record.
Select Submit at the bottom of the Third-Party form to finalize the record.
Once the Third Party and Product records are submitted, the assessment is in progress. At that point, the reviewer is able to create a new V-STAR assessment and assign back to the requestor to provide documentation. (HECVAT is Wharton's recommendation).
After You Submit
The request will move through Penn’s vendor review workflow in LogicGate.
For vendors identified as supporting Wharton, Wharton ISO will be assigned as the reviewer responsible for reviewing and launching the associated V-STAR. Depending on the vendor and the nature of the service, the review may also involve other Penn or Wharton stakeholders.
Requestors may be asked to provide additional information or documentation during the review. LogicGate will send email notifications when updates or actions are required.
You will also receive an email notification when the review is complete.
Once finalized, the V-STAR record is retained for future reference, and its linked Third Party and Product records remain available in LogicGate.
You can check the status of your review at any time from the My Work section of your LogicGate home page.
Initiative Review
When to Submit an Initiative Review
Submit an Initiative Review when you are planning a new initiative, introducing or changing a system interconnection, or making a significant technology or business change that may introduce information security, privacy, technology, or related risk.
Examples include:
Developing a new application
Introducing a significant new feature or capability
Establishing a new system-to-system interconnection
Creating or materially changing an integration, API, data feed, or automated data exchange
Making a significant architectural or infrastructure change
Before You Begin
Before starting the request, gather as much of the following information as possible:
Description of the proposed solution or change
Business purpose
Systems involved
Types of data involved and their data classification
Integrations, APIs, data feeds, or dependencies
Expected implementation timeline
Supporting architecture, data-flow, or project documentation, if available
Starting an Initiative Review
Go to the Wharton ISO website and click the Initiative Review button under "Submit a Risk Review."
Log in to LogicGate using your PennKey SSO credentials.
Select + Create Record, choose Request Initiative Review, and select Create.
Complete the required fields in the Wharton Computing Contact, Wharton Sponsor, and Determination sections.
If you answer Yes to “Has a vendor(s) and/or system(s) been identified for this initiative?”, a linked workflow section called Link Vendor to Initiative Review will appear.
In that section, select Browse Linkable Records, search for the Third Party associated with the initiative, and select Link for each applicable record.
If you answer No, no vendor records need to be linked and you can continue completing the remaining required fields.
Complete the requested information about the initiative, technology, systems, interconnections, and data involved.
Provide relevant documentation and any supporting information that is available.
Review your responses for accuracy and completeness.
Select Submit once all required fields have been completed.
After You Submit
Wharton ISO will review the information provided and determine whether additional information or review is needed. LogicGate will send email notifications when updates or actions are required.
You can check the status of your review at any time from the My Work section of your LogicGate home page.
You will also receive an email notification when the review is complete.
Findings and Remediation
As part of an Initiative Review, ISO may identify Findings that must be addressed.
A finding is a required action associated with implementation and may include a due date. Findings may take the form of:
A required action, such as implementing SSO
An acknowledgement, such as reporting suspicious activity to Wharton ISO
Each finding is assigned to a Remediation Owner, typically the person responsible for completing or acknowledging the required action. Supporting documentation or other evidence may be uploaded to demonstrate completion.
Completing a Finding
Open the finding using the link in the LogicGate email notification or from the My Work section of your home page.
Use the Process Update field to document progress as needed.
Update the Remediation Completion Status when the required work has been completed.
When the status is changed to Complete, fill out any additional fields that appear.
Select Submit to route the finding for review.
Wharton ISO will review the completed finding and follow up if additional information is needed.
FAQs
What is LogicGate?
LogicGate is the SaaS risk management platform used to submit, manage, and track Vendor and Initiative Risk Reviews. Requestors can access the appropriate review process through the Wharton ISO website.
How do I know whether I need a Vendor Review or an Initiative Review?
Use a Vendor Review when evaluating a third-party vendor, product, or service.
Use an Initiative Review when evaluating a new or significantly changed technology, system, project, initiative, interconnection, or integration.
How long does a risk review take?
Wharton ISO’s target is to complete risk reviews within two weeks, provided we have complete and accurate information and all documentation needed for review. More complex reviews, incomplete submissions, vendor follow-up, or required remediation may extend that timeline.
How far in advance should I submit a risk review?
As early as possible in the planning or procurement process!
For vendor reviews, we recommend beginning the review before a purchase or implementation decision is finalized. For initiative reviews, submit once the proposed solution, systems, interconnections, and data use are defined well enough to support review.
Submitting early allows time for follow-up questions, vendor documentation, or remediation if needed.
What happens to risk reviews that were started before September 30, 2026?
Risk reviews already in progress before September 30th will be completed using the previous review process. All new vendor and initiative risk reviews beginning September 30th should be submitted through LogicGate.
Who manages the Vendor Review process?
Penn manages the University-wide Third-Party Risk Management (TPRM) workflow, or vendor review process, in LogicGate. Wharton ISO does not manage that workflow. When Wharton School is selected as the organization associated with a vendor, Wharton ISO is assigned as the designated reviewer.
What if the vendor or product is already in LogicGate?
Before creating a new Third Party, search the All Third Parties table to determine whether the vendor already exists. Existing vendors may also have Product and V-STAR records available for review. Avoid creating a duplicate record when a Third Party or Product already exists.
When does an existing vendor need to be reviewed again?
An additional review may be needed when an existing vendor relationship changes in a way that could affect risk, such as a significant change in the product or service, data access, functionality, integrations, or scope of use.
If you are unsure whether an existing vendor requires a new review, contact Wharton ISO at security@wharton.upenn.edu.
What is the difference between a Third Party, Product, and V-STAR?
A Third Party is the company or organization providing a product or service.
A Product is the specific tool, service, or application being evaluated.
A V-STAR is the vendor security assessment associated with that Third Party and Product.
For example, the Third Party might be a company such as Meta, while the Product would be a specific service such as Facebook.
What documentation should I have available for a Vendor Review?
Wharton recommends providing a HECVAT when available, instead of asking a vendor to complete the bespoke V-STAR questionnaire.
How will I know if ISO needs additional information from me?
LogicGate will send an email notification when additional information or action is required. You can also view items requiring your attention from the My Work section of your LogicGate home page.
How can I check the status of my review?
Log in to LogicGate and check the My Work section of your home page. You can return to LogicGate throughout the process to review records assigned to you and monitor work in progress.
What do I do if a Finding is assigned to me?
Open the Finding from your LogicGate email notification or from My Work.
Use the Process Update and Remediation Completion Status fields to track your progress. When the required action is complete, change the status to Complete, provide any additional requested information or evidence, and select Submit to return the Finding to Wharton ISO for review.
Getting Help
Wharton ISO is available for requestors both during and after the transition to LogicGate. Please join our weekly office hours, or email security@wharton.upenn.edu for more support.