Vendor inventory & tiering
A consolidated register built from finance, procurement and SSO data — catching the vendors nobody put through procurement — tiered by data, access, privilege and criticality.
Loading page content
Executive summary
Most significant breaches now arrive through a third party, yet vendor risk in practice is a questionnaire sent at onboarding, answered by the vendor's sales team, filed, and never revisited while access quietly expands. This engagement rebuilds the programme around actual exposure — tiered by reach, assessed proportionately, contracted properly and monitored continuously.
Most significant breaches now arrive through a third party. Yet vendor risk management in practice is often a questionnaire sent at onboarding, answered by the vendor's sales team, filed, and never revisited — while the vendor's access quietly expands for years.
We rebuild the programme around actual exposure. Tiering is driven by what the vendor can reach: the data they hold, the systems they connect to, the privilege they hold, and how quickly their failure would stop your business.
Assessment depth then follows tier. Contracts carry enforceable security, privacy and AI clauses. Monitoring is continuous for the vendors that matter. And critically, there is an exit plan for the concentration risks — because the vendor you cannot leave is the one that will hurt you most.
Why vendor risk programmes underperform
Each capability below is a discrete workstream with its own owner, deliverables and definition of done.
A consolidated register built from finance, procurement and SSO data — catching the vendors nobody put through procurement — tiered by data, access, privilege and criticality.
Tier-appropriate due diligence, from a five-question screen for low-risk vendors to on-site assessment and evidence review for critical ones.
Security schedules, data processing agreements, AI clauses, breach notification windows, audit rights and sub-processor approval built into your standard paper.
External attack surface, breach intelligence, certification lapse and financial distress signals monitored for tier-one and tier-two vendors.
Identification of vendors whose failure would be unrecoverable, with documented, tested exit and substitution plans.
Sub-processor mapping for critical vendors so you can see the dependency chain past your direct supplier.
Each benefit is stated with the commercial consequence attached, because a capability without a consequence is a feature list.
Tiering driven by data held, systems reached, privilege granted and business criticality, with assessment depth following tier.
Assessment depth follows tier, so effort lands on the vendors that could cause material harm, not the ones that can't.
A five-question screen for low-risk suppliers and a gated deep assessment only where warranted.
Low-risk suppliers cleared on a five-question screen; only flagged suppliers go through deep assessment.
Security schedules, DPAs, AI clauses, breach windows, audit rights and sub-processor control built into standard paper.
Converts assurance from a filed questionnaire into a contractual right you can exercise.
Concentration analysis with documented and tested exit plans for critical suppliers.
Surfaces a commercial and resilience exposure that usually sits entirely unmanaged.
Phases overlap deliberately — design begins before assessment closes, so the programme does not stall waiting for a document to be signed off.
Weeks 1–3
Reconcile accounts payable, procurement records and SSO logs into a single vendor list — typically 30–50% larger than the one procurement holds.
Weeks 3–5
Classify by data sensitivity, system access, privilege level and business criticality, producing a defensible allocation of assessment effort.
Weeks 5–14
Run tier-appropriate due diligence on the critical population first, with findings tracked to remediation or accepted risk.
Weeks 10–20
Update standard templates and renegotiate the critical contracts that lack adequate protections.
Ongoing
Continuous monitoring, periodic reassessment by tier, and integration of vendor risk into procurement gates.
Named artefacts, listed in the statement of work. If it is not on this list, we will tell you before you sign rather than after.
Sector constraints change the delivery approach more than they change the obligations. These are the sectors this methodology is built around.
Fixed fee for defined scopes, retainer for ongoing services. We do not price advisory work on time and materials, because that misaligns our incentive with your outcome.
3 weeks
Organisations without a reliable view of their supplier base
Commercial basis: Fixed fee
14–20 weeks
Organisations rebuilding vendor risk management
Commercial basis: Fixed fee
Rolling
Organisations wanting assessments run continuously
Commercial basis: Monthly retainer
Every proposal states what is included, what is not, and what would trigger a change request. If the scope we recommend is smaller than the one you asked for, we will say so.
One implementation, cross-mapped. Each framework below links to its own obligations and control domains.
Specific answers about scope, timeline and what we will and will not do.
Ask a practitioner directly. First responses come from the person who would run your engagement, within one business day.
Ask a questionTurn data protection law into working product behaviour.
We map where personal data actually lives, rebuild consent and rights flows into your product, and leave you with a privacy programme that survives an audit and a board question.
Explore capabilityDefensible security, built around how your business actually loses money.
Threat-led security strategy, architecture and control design that prioritises the handful of scenarios that would genuinely hurt you — not a generic checklist of 300 controls.
Explore capabilityOne operating model for privacy, security, risk and AI accountability.
We design the committees, policies, decision rights and reporting lines that let trust obligations be managed as one programme instead of four competing ones.
Explore capabilityCombining capabilities reduces cost — the second framework typically lands at about half the price of the first.