Third-Party & Vendor Risk Management: Know Which Suppliers Could Breach You
Your security is only as strong as the suppliers who hold your data or connect to your systems. Payroll providers, software vendors, managed service providers and cloud platforms have all been the way in for major breaches. Vendor risk management means knowing who your critical suppliers are, checking their security and keeping watch over time.
Mutex Systems builds and runs third-party risk programmes. The work covers supplier tiering, proportionate questionnaires, evidence review, security clauses in contracts and continuous monitoring. It meets the supply-chain duties in DORA, NIS2, ISO 27001 and SBP outsourcing rules.
Or call our London office on 020 3307 529901Why it matters now
The risk behind this service
Based on incidents and figures in our UK & Europe threat report.
- Supply-chain attacks let one breach at a supplier or managed service provider reach hundreds of its customers at once.
- DORA requires EU financial entities to keep a register of ICT third parties and manage their risk; NIS2 does the same for supply-chain security.
- Sending questionnaires is not enough. Answers need checking against evidence, and risks need following up.
Who this is for
- Banks, insurers and fintechs subject to DORA, FCA or SBP outsourcing rules
- NIS2 essential and important entities
- Organisations with many SaaS and IT suppliers
- Companies preparing for ISO 27001 or SOC 2
- Procurement teams without security expertise
- Firms that have had a supplier-related incident
02Services
What we deliver
Supplier Inventory & Tiering
Find every supplier with access to data or systems and tier them by criticality and data sensitivity.
Security Questionnaires
Proportionate questionnaires by tier, based on ISO 27001, SIG-style and CAIQ question sets.
Evidence Review
Check ISO certificates, SOC 2 reports, pen-test summaries and policies, not just the answers given.
Contract Security Clauses
Security requirements, breach notification, right to audit and exit terms for supplier contracts.
Continuous Monitoring
External security signals, breach news and certificate expiry tracked for critical suppliers.
DORA Register of Information
Build and maintain the register of ICT third-party arrangements required under DORA.
Learn moreSupplier Remediation Tracking
Agree fixes with suppliers and track them to completion.
Programme as a Service
We run the whole programme for you, with reports to your risk committee.
Learn more03Business impact
What a vendor risk programme changes
How a structured programme compares with ad-hoc questionnaires.
| Factor | Ad-hoc questionnaires | ● With Mutex vendor risk management |
|---|---|---|
| Risk | Critical suppliers unknown; risky ones go unchecked. | Every supplier tiered, with critical ones assessed and monitored. |
| Cost & effort | Same long questionnaire sent to every supplier. | Effort proportionate to risk, so low-risk suppliers onboard quickly. |
| Regulatory standing | No DORA register or NIS2 supply-chain evidence. | Register, assessments and decisions documented for regulators. |
| Incident readiness | Supplier breach discovered from the news. | Breach-notification clauses and monitoring for early warning. |
| Procurement speed | Security review becomes a bottleneck. | A clear process with agreed timelines per tier. |
04How it works
How an engagement runs
- 1
Inventory
Collect suppliers from finance, procurement and IT records.
- 2
Tier
Rate each supplier by data, access and business criticality.
- 3
Assess
Send questionnaires by tier and review evidence.
- 4
Treat
Agree fixes, contract clauses or alternative suppliers for high risks.
- 5
Monitor
Continuous monitoring and periodic reassessment.
What you receive
- Supplier inventory and risk tiering
- Questionnaire templates by tier
- Assessment reports for critical suppliers
- Contract security clause library
- DORA register of information and committee reports
05Compliance
Frameworks and regulations this supports
DORA
ICT third-party risk management and the register of information.
NIS2 Directive
Supply-chain security is one of the required risk-management measures.
ISO 27001:2022
Controls 5.19 to 5.22 cover supplier relationships and monitoring.
SOC 2
Vendor management supports the Security criteria.
FCA Operational Resilience
Third parties supporting important business services.
SBP Cybersecurity Guidelines
Pakistani banks must manage outsourcing and third-party risk.
grComply · GRC platform
Supplier risk tracked with the rest of your risks
Supplier risks are recorded in the grComply risk register, linked to the supplier controls of every framework you hold and followed up like any other risk. The Questionnaire agent drafts answers to the security questionnaires your own customers send you, from your approved evidence, and people approve every answer.
Explore grComply- Supplier risks in the risk register with owners and treatment plans
- Review evidence stored against ISO 27001 controls 5.19 to 5.22
- Follow-up tasks and notes on each supplier review
- Questionnaire agent drafts customer answers for human approval
What is vendor risk management?
It is the process of identifying the suppliers who could affect your security, assessing their controls, managing the risks they bring and monitoring them over time. It is also called third-party risk management (TPRM).
Do we need to assess every supplier?
No. Tiering means critical suppliers, those with sensitive data or system access, get a full assessment, while low-risk suppliers get a light check or none.
What does DORA require for third parties?
DORA requires EU financial entities to manage ICT third-party risk, keep a register of information on all ICT third-party arrangements, include specific contract terms and plan exit strategies for critical services.
Is a supplier’s ISO 27001 certificate enough?
It is good evidence, but check the scope covers the service you buy and that the certificate is current. For critical suppliers, also review recent test results and incident history.
Can you run the programme for us?
Yes. We can run the full programme, including inventory, assessments, follow-up and committee reporting, or build it and hand it over to your team.
How long does it take to set up?
A first inventory and tiering usually takes a few weeks. Assessing critical suppliers follows in waves, depending on how many there are.
Can you help us answer our customers’ questionnaires?
Yes. grComply’s Questionnaire agent drafts answers from your approved evidence and policies, and your team approves every answer before it is sent.
Find out which suppliers carry the most risk
Start with a supplier inventory and tiering. Reply within one working day, or call 020 3307 5299.