Privacy and GRC Advisory
Most third party programs assess whoever replies. We build the register from your own records, tier it by what each supplier can actually touch, and examine the ones that matter against evidence rather than against a returned questionnaire.
Your worst incident is likelier to arrive through somebody else than through you. Everybody knows this, and the program that follows from it usually assesses whichever suppliers answered their email.
That is how a stationery supplier gets a questionnaire while the payroll provider with domain administrator rights does not, and how a customer asking which suppliers were assessed this period gets a list of suppliers instead of an answer.
Access decides the tier. A supplier who can reach your identity provider outranks one who bills you more and holds nothing.
Contracts, accounts payable and access records, reconciled against each other.
Suppliers with live access and no current contract surface here, and so do contracts nobody is paying for. This is the cheapest stage and usually where the surprise is.
Data held, systems accessed, and whether access ends when the contract does. That decides the tier, not the size of the invoice.
A supplier who can reach your identity provider outranks one who bills you more and holds nothing.
Out and back as documents, tracked by who received them and when. No portal anybody has to log into and no platform your suppliers must be onboarded to.
Non response is recorded as non response. Treating silence as a pass is how a register becomes fiction.
For tier one, the assertion is checked against something: an attestation report read rather than filed, a certificate with its scope actually examined, a configuration export, a contract clause.
A report covering a different service than the one you buy is a common and expensive discovery, and the exceptions are at the back.
Some supplier findings are contractual and some are technical. They go to the team that can act on them rather than arriving as one list that belongs to everybody.
The contractual ones are usually the slowest, which is why they should not wait behind the technical ones.
Which tier one suppliers were assessed this period, which are outstanding, and which have never been assessed at all.
The gap is the deliverable. A register without it describes activity rather than assurance.
A returned questionnaire is an assertion. Most programs file it as evidence, which means the register records what suppliers said about themselves and presents it as assurance.
Here a questionnaire answer stays an assertion until something is examined, and it is marked as one. For tier one that means reading the attestation report rather than noting that it exists, checking the scope statement rather than the certificate, and asking for the clause rather than believing the summary.
The register is also yours to run afterwards. Tiering rules, questionnaire and cycle dates are handed over, so adding a supplier next month does not mean calling us.
Customers increasingly ask what you do about your own suppliers. A coverage position answers it; a list of suppliers does not.
Every register surfaces a supplier with live access and no current contract. That is the cheapest risk reduction in the engagement.
Underwriters ask which suppliers were assessed and when. Being able to answer changes the conversation and sometimes the premium.
Tiering by reach rather than by spend means the assessment budget lands on the suppliers who could actually cause the incident.
You tell us what prompted the question. A customer questionnaire, an insurer, a board, or a date somebody gave you.
Thirty to forty-five minutes establishing what applies to you and what does not. Not charged, and not a sales call: if the answer is that you need less than you thought, or somebody else entirely, we say so.
What is in, what is out, what you have to supply, the fee and the end date. Nothing starts until you have it in writing.
Delivered against that scope. If something has to change, we agree it in writing first, including what it costs.
The deliverables, plus the evidence and the method, so the work can be repeated by somebody who is not us.
Fixed fee against an agreed scope. Nothing is billed hourly and the scope does not move without your written agreement. The fee is quoted rather than published, because a number carrying an asterisk is worth less than a straight answer, and scope is what decides it. You own the output. Editable files, no platform, no license, no lock-in.
As many as the tiering warrants. The register covers everybody; the depth of assessment follows the tier, so cost scales with how many suppliers can actually reach something rather than with how many you pay.
Recorded as non responsive, with the dates and the attempts. That is a finding about your leverage and it is often the most useful one in the report.
No. We assess on a cycle. Nothing here watches a supplier between assessments, and a service claiming otherwise is describing a platform rather than an engagement.
Externally scraped scores measure what is visible from the internet, which is not what your supplier can reach inside your business. We will read one if you hold it, and it will not settle anything on its own.
Speak to your suppliers as you, test a supplier's systems, or assess your supplier's own suppliers beyond what your contract entitles you to ask. Where that right is absent, the absence is the finding.
Almost every organization can produce a supplier list from accounts payable in an afternoon. Comparing it against who holds an account in your systems costs nothing, and it is usually where the surprise is.
Related services: Data Protection Compliance Program · Data Protection Impact Assessment