Rippling Vendor Risk Assessment — Full Report

Recommended Actions

Steps to address findings for Rippling

1. 1

   PRIORITY 1 — Complete sanctions screening manually: Since automated sanctions screening was unavailable, run Rippling (and its parent entity Rippling People Center, Inc.) through the OFAC SDN search tool at https://sanctionssearch.ofac.treas.gov/ and the EU consolidated sanctions list. Document the search date and results in your TPSP file.

2. 2

   PRIORITY 2 — Obtain and review the SOC 2 Type II report: Contact Rippling's security team via their trust portal (https://trust.rippling.com) or email security@rippling.com to request the current SOC 2 Type II report under NDA. Verify that HR data processing, payroll processing, and any components relevant to your CDE are explicitly within scope. Flag any exceptions noted by the auditor for remediation tracking.

   SOC 2 Overview (AICPA)DPA Template (GDPR Art. 28)
3. 3

   PRIORITY 3 — Execute a Data Processing Agreement / Service Provider Addendum: For CCPA compliance, obtain Rippling's signed Service Provider Addendum that explicitly prohibits the sale or sharing of California consumer personal information. For GDPR, obtain a Data Processing Agreement covering EU employee data. Both documents should be retained in your vendor contract file. Rippling's legal team can be engaged via https://rippling.com/legal.

   GDPR Full TextCCPA Overview (CA AG)DPA Template (GDPR Art. 28)
4. 4

   PRIORITY 4 — Document shared responsibility for PCI-DSS controls: Complete a PCI-DSS shared responsibility matrix with Rippling to document which controls (encryption at rest, access logging, incident response notification SLAs, etc.) are managed by Rippling vs. your organization. This is required under PCI-DSS 4.0 Requirement 12.8.5 and will be requested by your QSA.

   PCI DSS StandardsNIST Incident Response Guide
5. 5

   PRIORITY 5 — Resolve the subprocessor visibility gap: Visit https://trust.rippling.com/subprocessors directly and manually catalog the subprocessors Rippling discloses. Identify any subprocessors operating in high-risk jurisdictions or handling sensitive payroll or employee data on Rippling's behalf. Confirm each is covered by appropriate contractual protections under GDPR Article 28.

   GDPR Full TextGDPR Subprocessor Rules
6. 6

   PRIORITY 6 — Address HTTP security header gaps: Rippling's web application is missing Content-Security-Policy (CSP) and X-Frame-Options headers, resulting in a C+ HTTP security grade. While this is a vendor-side configuration issue, raise it with Rippling's security team as part of your vendor review — particularly relevant if your employees access Rippling via embedded iframes or single-sign-on workflows. Request a timeline for remediation.

   CSP Reference (MDN)

• Sanctions and watchlist screening (OFAC, EU, UN lists) was unavailable during this investigation due to a source outage. This is a critical screening category for any vendor with medium or higher data access. Manual sanctions screening against OFAC's SDN list (sanctionssearch.ofac.treas.gov) and EU consolidated sanctions list should be performed before final approval.
• Certificate Transparency log data was unavailable during this assessment. This source is used to identify unexpected subdomains and certificate issuances that may indicate shadow IT or certificate mismanagement. This gap does not affect the primary risk determination but represents a missing supplementary signal.
• Web archive history data was unavailable during this assessment. Domain age was confirmed via WHOIS (24+ years), so this omission does not affect the domain establishment assessment.
• Rippling's subprocessor page at trust.rippling.com was located but could not be parsed into structured entries due to a non-standard page format. Subprocessor identity, jurisdiction, and individual risk assessments could not be completed. This is particularly relevant for GDPR Article 28 compliance and PCI-DSS TPSP chain-of-custody obligations.
• External cyber risk scoring data was not available during this investigation, representing a gap in the quantitative security posture assessment. The qualitative signals from other sources remain sufficient to support the Tier 4 determination.