Third-party risk management
Trust your suppliers.
Be trusted by
your customers.
We run third-party risk for you, build it with your team, or build it into your own environment.
Regulated UK organisations and the suppliers that serve them.
Regulations
NIS2
DORA
UK NIS Regulations
Cyber Security and Resilience Bill
UK & EU GDPR
Art. 28
EU AI Act
EU Cyber Resilience Act
UK Critical Third Parties regime
PRA SS2/21
outsourcing
FCA SYSC 8
EBA Outsourcing Guidelines
Procurement Act 2023
Telecoms Security Act
CSDDD
supply chain due diligence
Modern Slavery Act
DEFCON 658
Def Stan 05-138
NHS DSPT
Standards and frameworks
ISO/IEC 27001:2022
A.5.19–5.23
ISO/IEC 27036
supplier relationships
ISO 28000
supply chain security
ISO 22301
continuity
ISO/IEC 27701
privacy
ISO/IEC 42001
AI management
NIST CSF 2.0
GV.SC
NIST SP 800-161
NCSC CAF
NCSC Supply Chain Principles
Cyber Essentials Plus
SOC 2
CSA STAR
PCI DSS v4.0
CIS Controls v8
CMMC / DFARS
Sound familiar?
What people tell us first.
You know third-party risk matters. You’re just not sure you’re doing enough, or the right thing. Every part of your business depends on suppliers, yet the risk often sits with one person, or no one.
YOUR REGULATOR
“Our regulator wants evidence we’re managing supplier risk.”
We build a programme that stands up to DORA, NIS2 and the Cyber Security and Resilience Bill, and run it if you want us to.
INCOMING · REGULATOR
EVIDENCE REQUEST
Supplier oversight, due in 14 days
GAP FOUND
14 critical suppliers never assessed
YOUR RESPONSE
Draft, evidence incomplete
Maturity and readiness →
YOUR SUPPLIERS
“We don’t actually know who all our suppliers are.”
We find the ones procurement never listed, rank them by risk and keep watch on the critical few.
YOUR SUPPLIER PICTURE
61
ON REGISTER
312
IN USE
What procurement sees
What you actually rely on
T1
14
T2
58
T3
240
+251 suppliers procurement never listed
Managed third-party risk →
YOUR CUSTOMERS
“Another customer has sent a 300-question security review.”
We build your evidence once and keep it current, so questionnaires stop slowing down your sales.
SECURITY QUESTIONNAIRE
Q1
Do you hold ISO/IEC 27001 certification?
Q2
Describe your incident response process.
Question 1 of 300
0%
Due Friday · 3rd this month
Customer assurance →
BEFORE YOU SIGN
“We’re about to sign with a major supplier, partner or acquisition, and don’t know what we’re inheriting.”
We check their security, suppliers and obligations before you commit, so you can fix it, price it in or walk away.
PRE-CONTRACT CHECK
3 RED FLAGS
Found before signing
INHERITED
9 flow-down clauses, 62% on one host
YOUR CALL
Fix it, price it in or walk away
Third-party due diligence →
Both directions
You rely on suppliers. Customers rely on you. We give you insight on the first and evidence for the second, so what you demand and what you can prove always line up.
YOUR SUPPLIERS
Can we trust them?
Cloud hosting
Monitored
Payroll provider
Verified
Logistics partner
Triaged
SaaS vendor
Verified
148
In scope
3
Need action
INTELLIGENCE IN →
Supply. Assured.
Intelligence in. Evidence out.
One view of both directions.
Intelligence-led tiering
Analyst triage
Evidence at source
Board-ready reporting
EVIDENCE OUT →
YOUR CUSTOMERS
Can they trust you?
Questionnaire
Answered
Customer audit
Scheduled
Assurance profile
Shared
Tender pack
Submitted
92%
Pre-answered
48h
Avg. response
Example dashboard
What we do
Run for you. Built with you. Owned by you.
RUN FOR YOU
Managed third-party risk
Our analysts and assessors run the programme on a library of leading platforms. You get the outcomes without buying, configuring or running another tool.
01
Managed third-party risk
Onboarding, tiering, assessment, monitoring, remediation and board reporting.
02
Audits and assessments
Remote and on-site audits of critical suppliers, scoped to risk tier.
03
Customer assurance
Evidence packs, questionnaire responses and audit readiness for your customers.
Explore managed services
BUILT WITH YOU
Third-party risk consultancy
Senior practitioners who have run security and supply chain risk in defence, nuclear and critical national infrastructure, working alongside your team.
01
Maturity and readiness
Benchmark your programme against DORA, NIS2, ISO/IEC 27036 and your regulator.
02
Programme design
Policy, risk appetite, tiering model and contract clauses.
03
Third-party due diligence
Before you sign with critical suppliers, partners or acquisitions.
Talk to a consultant
OWNED BY YOU · TPRM-IN-A-BOX
Own the capability,
not the licence
A third-party risk capability built inside your own environment, on the platforms you already run. You own it outright.
Built in your own environment
Your data, suppliers and evidence never leave your environment.
AI-assisted from day one
Tiering, questionnaire review, evidence analysis and board reporting, with a human in the loop.
No per-supplier licence
Handover, training and optional support. Scale your supplier base without scaling cost.
Ask about TPRM-in-a-box
Who’s behind it
Experienced people. Sharper intelligence.
Always-on threat intelligence
Financial distress, sanctions and ownership changes, breaches, extortion claims and regional disruption, matched to your suppliers continuously. Our analysts triage every signal before it reaches you.
Live supplier signals
Illustrative
Financial
Credit downgrade at a single-source component maker
2m
Sanctions
Ownership change flagged at a freight forwarder
14m
Breach
Credential leak linked to a payroll provider
1h
Port disruption near a critical supplier site
3h
Extortion
Leak-site claim naming a tier-2 logistics subcontractor
5h
1,240
Signals screened this week
37
Triaged by our analysts
5
Escalated to you
See the suppliers your register misses
We build your supplier picture from your systems and spend, not just the procurement register, then show which relationships are live, which have lapsed and where risk concentrates.
On the procurement register
Found in your systems and spend
Your organisation
One flaw, four tiers deep
One vulnerable component cascades through sub-tiers to you. We trace who is exposed before it lands.
Exposed
Not affected
You
61
On register
312
Found
48
Lapsed
Controls checked at source
AI-assisted collection reads controls directly from supplier and internal systems and re-checks them continuously. Our assessors review and sign off every conclusion.
MFA enforced on admin accounts
Verified
Backups restored and tested
Verified
Encryption at rest
Verified
Incident response plan
Awaiting
Supplier access reviewed
Verified
Control coverage
80% verified
Risk, mapped to place
Supplier sites are geolocated and live events plotted against them, so disruption near a critical site is flagged early.
Port strike, 12 km from tier-1 site
High
Flood alert near a supplier depot
Watch
Sanctions widened to a sub-tier region
Review
One connected picture of risk
Suppliers, systems, data flows and controls sit in a single linked model. Every finding traces back to its evidence, so boards and auditors can see exactly why a decision was made.
TRACE
Board finding
Control gap
Evidence
Sub-tier supplier
9,400
Relationships mapped
100%
Findings traced to evidence
1 click
From board report to source
One assurance profile. Every customer.
When you are the supplier, a single verified assurance profile answers customer reviews faster and ends repeat questionnaires.
Assurance profile verified
Shared with your customers
ISO/IEC 27001 certificate
Current
Cyber Essentials Plus
Valid
Penetration test summary
Q3 2026
Security questionnaire
Pre-filled
Regulatory direction
Continuous, not annual
Ongoing monitoring of supplier services replaces the yearly questionnaire.
DORA · ISO/IEC 27001 A.5.22
Deeper visibility
See beyond tier one. Regulators can now designate critical suppliers in their own right.
NCSC PRINCIPLES · CS&R BILL
Board-level accountability
The management body owns third-party risk, and can be held to account for it.
NIS2 ART. 20 · DORA ART. 5
Proportionate approach
Controls scaled to each supplier’s criticality, not one size for all.
NIS2 ART. 21 · DORA ART. 4
Resilience focus
Plan for supplier failure, with tested exit strategies, not just compliance.
DORA ART. 28 · ISO 22301
Evidence-based assurance
Outcomes you can demonstrate to an auditor or regulator, not self-attestation.
NCSC CAF · ISO/IEC 27001
Formal risk management
A documented strategy, a register of third parties and recorded treatment decisions.
DORA ART. 28 · ISO 28000
Incident reporting in hours
24-hour early warnings mean your suppliers must tell you fast, and you must act faster.
NIS2 ART. 23 · CS&R BILL
Our method
Six stages. One continuous chain.
One lifecycle, whichever way the risk flows. Baselined once, then kept running.
01
Identify
Identify and categorise every supplier by criticality and security exposure.
02
Map
Trace dependencies through the sub-tiers to reveal cascading risk.
03
Assess
Test control effectiveness, in proportion to each supplier’s tier.
04
Fix
Remediation, contract clauses and exit plans.
05
Measure
Track performance with live metrics and continuous monitoring.
06
Assure
Validate compliance and give your board and customers confidence.
Next step
Book a free health check
WHAT HAPPENS NEXT
01
Book a call
Free, virtual and no preparation needed.
02
We talk it through
Your suppliers, your customers and the regulations in play.
03
You get an honest view
Where you stand, and what to look at first.