Open the vendor scorecard and go to the digital footprint or domains view. Expected: you can list every domain counted toward the vendor score, and the parent company domains stand out by name or registration.

Pick one wrong finding and open its detail. Expected: the affected asset is a parent domain, which confirms an attribution problem rather than a real vendor issue.

Compare against the parent company scorecard. Expected: the same domains and findings appear there too, confirming the domain set overlaps between the two scorecards.

Remove the parent domains from the vendor view you control: if you built a custom scorecard or portfolio for the vendor, edit its domain scope to the vendor-operated domains only. Expected: the vendor score recalculates from its own footprint and the parent findings leave the assessment.

For the automatic public scorecard mapping, submit an attribution correction request with evidence the domain is operated by the parent (registration records, the parent's own site listing the domain, certificate organisation fields). Expected: the request is logged as an attribution fix, which moves the domain for all viewers rather than only your portfolio.

While the correction is pending, annotate the vendor record in your risk register: note which findings are parent-attributed so reviewers do not score the vendor on them. Expected: the current assessment shows the adjusted view and the pending correction side by side.

Recheck after the next scorecard refresh cycle. Expected: the vendor footprint no longer lists the parent domains and new parent findings stop appearing in the vendor assessment.