My Assessment Portal

UX Design Meets Third Party Security

My Assessment Portal is an internal software used by Amazon to track third-party security assessments. Working as the only UX designer, I collaborated with a project manager for six months to bring this project to completion.

"How might we design an intuitive and user-friendly interface that simplifies the TPS certification process for Requesters, Vendors, Assessors, and Business Security Teams, thereby reducing the time and effort required to complete it?"

Challenge

Amazon’s security teams want to minimize the time required for third-party security assessments; from the time of the request to when vendors are thoroughly assessed, approved, or denied.

To conduct a security assessment, three stages must be completed: a request made by a "Requester," a deep dive questionnaire completed by the third-party the "Vendor" being assessed, and an "Assessor" review to identify any security risks.

When each person operates on their own schedule, or when there is significant terminology confusion, and conflicting dashboard views, it becomes challenging to track and shorten the duration of an assessment.

User Interviews

To kick off the project, I started first by conducting research. As part of my research, I interviewed 20 internal users via Zoom video calls. These interviews included participants from various business teams who had previously requested a third-party security vendor assessment (our Requesters) , and participants that were reviewing those requests and conducting the assessments (our Assessors). Although I was unable to interview vendors directly, Requesters provided valuable feedback from them.

Here were some key findings:

1. Tracking assessments is difficult due to disparate stages and states for each attached record, making it impossible to get a complete view of the assessment's trajectory.

2. Significant stalling of assessments is typically caused by widespread confusion around terminology and workflow processes;

3.Providing technical support can be a challenge due to the different dashboard views of requesters, assessors, and vendors, making it difficult to troubleshoot issues.

4. There is a previously unidentified user group that we need to prioritize, who I consider to be our outliers.

User Personas

The greatest insight for me was the discovery of a new user group that was crucial to the success of the third-party assessment process - the Business Security Teams (BSTs). These teams played a significant role in maintaining security and compliance within their respective business teams.

Although they may not use the dashboard as frequently as the other user groups, it was essential to design with them in mind. They needed to have a say in how assessments were tracked and how security risk findings were managed and remediated to ensure their business teams were compliant. As a result, I made sure to incorporate their feedback and insights into the design of the dashboard.

Finding Opportunity

I analyzed each user's journey to identify potential improvements for each dashboard, as well as opportunities to unify and integrate all dashboard features into a cohesive whole.

feel free to click, expand and explore :)

Requester's User Journey

Vendor's User Journey

Assessor's User Journey

1/3

In summary of all of my data...

Users were struggling to track the progress of their assessments, causing delays and frustration in the TPS certification process.
Without a centralized platform for communication, users were finding it difficult to share important information and updates related to the TPS certification process.
Users were unsure of what steps they needed to take next to move their assessment(s) forward, leading to confusion and delays in the certification process.

User Problem Statement:

Users need a platform that provides them with real-time updates on their assessment progress, enabling them to make informed decisions and stay on top of the TPS certification process.

Stages and States

Keeping track of the assessment process was a complex task due to the presence of multiple records and states associated with each record. To address this issue, my colleague Aaron and I focused on redesigning the assessment process itself rather than adding features to the dashboard. Our goal was to align the states and stages of any records required for the process. Initially, there were five stages, out of which two were no longer in use and the other three had their own states and stages.

Through several brainstorming sessions and a trip to Austin to meet the team, we were able to realign the records and their states into one overarching flow for the entire TPS assessment process. We kept the three stages that were still in use but renamed the states of each record to create a cohesive and sensible structure. The new state flowchart helped us to simplify the process and make it more manageable for all involved.

TPS Revamped Assessment Flow

Click here to see what it looked like before :)

Must-haves

After streamlining the stages and states, my next focus was to develop prioritization features that addressed the users' needs. Two key features stood out as essential to users

1. Record Management System: Users needed a central system to keep track of all assessment-related forms, including intake forms, deep dive questionnaires, security risk finding records, uploads, and updates.

2. A Solid Communication Channel: It was crucial to provide users with a stable and reliable means of communication. This would help track remediation progress and provide assistance with third-party security jargon.

Additionally, it was important to provide a clear walk-through of the assessment process, particularly for first-time and one-time users. As assessors were the only group that worked with the dashboard daily, it was critical to design the system with their workflows in mind.

Finally, to address users' uncertainty regarding the next steps to take, I introduced a "Take Action" feature that helped guide them through the process.

Mock-ups Wireframes

TPS Assessment Portal BEFORE

Main Dashboard Mockup
LOFI

Project Details Mockup
LOFI

Usability Testing & Results

I received overwhelmingly positive feedback after testing the prototype with users.

Color coordinating the different states allowed users to quickly analyze which assessments needed their immediate attention.

The take-action and to-do list features were equally popular, indicating that users had their preferred way of managing their daily tasks.

100% of users found the new dashboard to be much more consumable and easy to understand, allowing them to quickly see what was happening with their assessment.

Users intuitively found all documentation and communication related to a single assessment. Centralizing everything in one high-level record made communication easier and more accessible between all parties involved.

Although there were some additional feature requests, the focus was on delivering the most valuable and lovable product within a six-month time frame. Both stakeholders and users were pleased with the first version of Amazon's new third-party assessment portal

The "final" Touch

TPS Assessment Portal
AFTER

Project Details
-DETAILS-

Project Details
-DOCUMENTS-

Project Details
-ISSUES-

Project Details
-ACTIVITY-

Takeaways

The process of designing the dashboard for this project was both challenging and rewarding.

The biggest challenge was fully understanding the Third Party Assessment experience and designing an entirely new application within the allotted time frame of 6 months. It was crucial that I was proactive with meeting with different teams within the organization to get different perspectives on the product.

Furthermore, this assignment allowed me to further develop my skills in design systems, as I was able to create new design guidelines that were specifically tailored to this project's needs. I am excited to continue expanding my knowledge and expertise in this area by exploring new opportunities to build and create documentation for future design systems.

My final thoughts….

Overlooking outliers is common, but these individuals and their unsolved problems are often the sources of innovation.
Sometimes, user issues can be traced back to the workflow processes of the company rather than the software itself, underscoring the importance of examining the broader user experience.
Simple changes like changing the name of the states can go a long way. Speak the users language.