Tiered questionnaires
Short forms for low-risk vendors, deep reviews for critical ones. Vendors answer through a secure link.
L4GUARDED DOOR / F-04
Home / Platform / Vendor Risk
Vendor RiskKnow which vendors hold your data, and on what terms.
Keep one inventory of vendors and sub-processors. Tier them by risk, send questionnaires, track DPAs and assurance reports, and get warned before something expires.
vendor-risk
VendorTierAssuranceDPA
Cloud hostingCriticalISO 27001 cert on fileSigned
Payments gatewayCriticalSOC 2 Type II, valid to Mar 2027Signed
Email deliveryHighQuestionnaire 100%Missing
Product analyticsMediumQuestionnaire 80%Missing
Support deskMediumAwaiting responseSent
HOW IT WORKS
Four steps, then it runs on its own.
- 01
Discover
Import vendors from finance exports or SSO apps. Add the data each one processes.
- 02
Tier
Rate each vendor by data sensitivity and business criticality.
- 03
Assess
Send questionnaires sized to the tier and collect certificates, reports and DPAs.
- 04
Monitor
Renewal and expiry alerts, annual reassessment and a live sub-processor list.
CAPABILITIES
What Vendor Risk does for you.
DPA tracking
Track sent, signed and missing data processing agreements, including processor obligations under DPDP.
Assurance reports
Store ISO certificates and SOC 2 reports with validity dates and bridge letters.
Expiry alerts
Owners are warned 60 and 30 days before a certificate or contract lapses.
Risk ratings
Inherent and residual risk with notes, linked to the Risk Register.
Sub-processor list
Publish the current list on your Trust Page automatically.
IN DETAIL
Why it matters for each framework
ISO 27001
Annex A controls 5.19 to 5.23 cover supplier relationships, agreements, ICT supply chain, monitoring and cloud services.
SOC 2
CC9.2 expects you to assess and manage risks from vendors and business partners.
DPDP
A Data Fiduciary may engage a Data Processor only under a valid contract and remains responsible for compliance.
QUESTIONS
About Vendor Risk
Do vendors need an account?
No. They complete questionnaires and upload documents through a secure, expiring link.
Can we reuse answers from a vendor’s Trust Page?
Yes. Attach public documentation and only ask the questions it does not answer.
How many vendors can we track?
Unlimited on Level 2 and Level 3.
L6 / DATA CORE
Seal the core.
Connect up to three tools and see exactly where you stand against one framework. Free, read-only, and live in about fifteen minutes.
Start readiness check freePrefer to walk through scope first? Contact us