01
Vendor system of record
Vendor inventory
Criticality and ownership
Relationship state
Reassessment history
Vendor Portfolio
12 assessed 1 high-risk
B
Acme Cloud ServicesCritical
74
C
DataFlow AnalyticsHigh
58
A
SecureAuth ProCritical
91
Product detail
AvailableThird-Party Risk Management
Replace spreadsheets, scan blindness, and email follow-up with one structured vendor risk operating model.
Vendor Risk Hub combines buyer-side structured assessments, continuous security monitoring, and reassessment workflows in one system. Track vendor posture with real security signals — not just questionnaire answers. Manage the full lifecycle from discovery through reassessment.
What this replaces
01Spreadsheet vendor trackers
02Email-driven questionnaire follow-up
03One-off DDQ responses that expire in a drawer
04Manual reassessment chasing
05Vendor risk blind spots between assessments
Proof points
Structured and versioned
Assessment model
NIS 2, DORA, ISO 27001
Regulatory frameworks
Connected security signals
Posture context
Enterprise security teams
Built for
How the workflow runs
The value comes from turning what is normally fragmented into one connected buyer-side operating flow for third-party risk teams.
01
Register the company
Start with a tracked vendor record or a new off-platform responder.
02
Choose the diligence path
Request shared assurance materials, send a questionnaire, or combine both depending on the relationship.
03
Collect structured responses
Use standard or custom templates, versioned at send time, with a dedicated response workspace.
04
Review what has already been shared
Use trust materials, prior responses, and existing assurance artifacts before asking the vendor to repeat work.
05
Monitor posture continuously
Track security rating changes, new exposures, and external signals between formal assessments.
06
Review evidence and coverage
Cross-reference questionnaire responses against external security signals and trust materials.
07
Track lifecycle and revalidation
Keep assessment state, reassessment triggers, and vendor lifecycle visible instead of buried in inbox threads.
Full module capabilities
The vendor record, the assessment flow, and the security signal should live in one place.
This is a buyer-side third-party risk operating model spanning discovery, continuous security monitoring, structured assessment, and full lifecycle management.
02
Assessment operations
Standard templates
Custom questionnaires
Guest responder workspaces
Assessment version binding
Assessment workflow
Created
Sent
In progress
Reviewed
Revalidation
03
Assurance intake and review
Trust requests
Selective inbound sharing
Assessment-linked evidence review
Review traceability
04
Continuous security monitoring
Vendor security ratings (A-F)
External attack surface signals
Real-time monitoring events
Concentration risk analysis
Questionnaire model
Questionnaires are where most third-party programmes become repetitive. This product is built to make that work reusable without losing control.
01
Standard and custom templates
Run industry-standard questionnaires as the baseline, then duplicate and tailor them for your own programme without breaking version history.
Platform templates remain immutable
Company templates branch from approved versions
Assessments bind to the exact template version sent
02
Review once, preserve context
Keep structured response history, evidence references, and review notes attached to the assessment so buyer-side diligence improves over time instead of restarting from scratch.
Versioned response history
Evidence-linked review trail
Assessment-to-reassessment continuity
Built for regulatory compliance
Pre-built assessment templates aligned with the regulatory frameworks buyers actually need, not generic checklists.
01
NIS 2 Supply Chain Security
Article 21 aligned template covering supply chain governance, incident reporting obligations, and coordinated vulnerability disclosure.
02
DORA ICT Third-Party Risk
Articles 28-30 aligned template for financial entities covering ICT service provider oversight, subcontracting transparency, and exit strategy provisions.
03
ISO 27001 Supplier Security
Annex A controls A.5.19 through A.5.22 covering supplier relationships, agreements, ICT supply chain management, and service delivery monitoring.
04
SIG Questionnaire Baseline
Industry-standard SIG-aligned template as the platform baseline, with duplicate-to-customize workflow for company-specific extensions.
Security monitoring closes the blind spot
Questionnaires tell you what vendors claim. Security monitoring tells you what is actually happening between assessments.
01
Vendor security ratings
Every vendor gets a composite security grade (A through F) blending external attack surface signals, vulnerability data, cloud posture, and compliance status.
Letter-grade ratings updated continuously
Domain-level score breakdown
Trend tracking and historical comparison
02
Continuous monitoring events
Get alerted when a vendor's posture changes — new exposures, certificate issues, credential leaks, or breach detections — without waiting for the next scheduled assessment.
Real-time event feed per vendor
Severity-based prioritization
Acknowledge and track resolution
What makes it better than email and spreadsheets
01
Vendor state stays visible
Ownership, criticality, latest activity, guest responder state, and shared trust signals live in one place instead of multiple trackers.
02
Buyer and responder workflows meet cleanly
Trust sharing and assessments stay connected. Buyers can start from approved materials vendors have already shared instead of restarting the conversation in another tool.
03
Reassessment becomes operational
Versioned questionnaires and shared-response history make it practical to revalidate instead of rerunning the entire process manually.
04
It supports service-led delivery too
The operating model is compatible with managed follow-up, assessment coordination, and optional trust review support when teams want operational relief.
05
Dual-source risk intelligence
Cross-validate what vendors tell you in questionnaires against what external security monitoring actually shows. One-sided diligence is not diligence.
06
Regulatory-ready from day one
Pre-built NIS 2, DORA, and ISO 27001 assessment templates mean you start with the regulatory structure you need instead of building custom questionnaires from scratch.
Built for buyer-side third-party risk teams
Designed for real operating roles, not generic personas.
Buyers and third-party risk teams
Track suppliers, send assessments, review shared materials, and schedule reassessments without losing control of ownership or status.
Procurement and business owners
See which vendors are waiting, which reviews are overdue, and which suppliers have already shared enough posture to move faster.
Security and assurance reviewers
Cross-check supplier claims against continuous security monitoring and keep evidence review tied to vendor criticality and business context.
Platform fit
See how Third-Party Risk Management fits inside the wider platform.
The product stands on its own, but it becomes more valuable when it connects to governance, trust, audit readiness, and operational security in the same system.