Third-Party Risk

Profiles with contacts, documents and contracts, including renewal dates.

Contract renewal is the only moment you have leverage to fix a security clause. Knowing the date in advance is the point.

Criticality tiering that drives assessment depth and cadence rather than being a label on a profile.

Assessing every vendor to the same depth means the critical ones get the same attention as the stationery supplier. Tiering fixes the allocation.

Build your own sectioned and scored questionnaires. A SIG-Lite-style starter template ships with the product.

Scoring at the template level is what makes two vendor responses comparable. Free-text answers never are.

Issue to a set of vendors, chase automatically, score the returns and turn weak answers into findings.

Chasing is the work. Automating the chase is most of the value in this module.

An external portal where the vendor answers, uploads documents and responds to queries, without an account in your tenant.

Requiring a vendor to be provisioned in your identity system is why questionnaires come back as email attachments instead.

Which vendors touch which assets, so an incident at a supplier scopes against your estate instantly.

When a supplier discloses a breach, this link is the difference between an answer in minutes and a week of asking around.

Scheduled re-assessment driven by tier, with automatic reminders when one falls due.

A vendor assessed once at onboarding and never again is one of the most common third-party findings.

Findings raised from vendor assessments, tracked to closure in the same findings model as audit and incident findings.

A vendor weakness and an internal audit weakness compete for the same remediation capacity. One model lets you prioritise across both.