Outsourcing a service does not outsource the risk. Regulators expect you to know your critical vendors, assess them before onboarding and keep watching them afterwards.
We build a proportionate program — deep reviews for critical suppliers, light checks for the rest — so effort goes where the risk is.
Why it matters
Vendor inventory and risk tiering
Due-diligence questionnaires
Security clauses for contracts
On-site and remote assessments
Continuous monitoring and reassessment
How the engagement runs
- 1InventoryVendors, services and data shared
- 2TierRisk-based classification
- 3AssessQuestionnaires, evidence and reviews
- 4MonitorReassessment cycle and issue tracking
What you receive
- Third-party risk policy and procedure
- Tiered vendor register
- Questionnaire library
- Contract security schedule
- Vendor assessment reports