Vendor Intelligence & Risk Register
From supplier register to provable supply chain security: one register brings together criticality, contracts, risks and external ratings — and seals every state as verifiable evidence.
Vendor and risk data that belong together.
The central vendor register tracks vendors with a criticality rating (critical/important/other), contract terms, LEI code, country, concentration-risk flag, and an approval workflow. Vendors synced from integrations remain traceably distinct from manually created ones; any manual change to a synced record is logged as an override.
AI-assisted reclassification suggests criticality with a rationale and confidence score; external security ratings (BitSight, SecurityScorecard) are visible directly on the vendor record, alongside sent security questionnaires.
Two registers are available for risk: an ISO 27005 risk register with threat/vulnerability pairs per asset, and an organization-wide, generic risk register with a 5×5 heatmap, residual-risk calculation, approval workflow, and sealed risk snapshots as of a given date. The DORA Register of Information is generated directly from vendor and asset data, versioned and sealed — exportable as CSV or XBRL.
What Vendor Intelligence & Risk Register deliver.
Vendor register with AI classification
Criticality rating, contract data, LEI code, concentration-risk flag; AI-assisted reclassification with rationale and confidence score.
External security ratings & questionnaires
BitSight and SecurityScorecard ratings directly on the vendor record; send security questionnaires and collect responses.
Risk register (ISO 27005 + generic)
Threat/vulnerability pairs per asset, plus an organization-wide 5×5 heatmap register with residual-risk calculation and sealed snapshots.
Vulnerability management
A vulnerability register linked to assets, with status tracking from open to remediated and an automatic remediation date.
DORA Register of Information
Generated directly from vendor and asset data, versioned and sealed; export as CSV (T01/T02/T04) or an XBRL manifest.
Supply chain security you can prove.
Compliance and security for your supply chain — from one register, cryptographically sealed.
Concentration risk, calculated deterministically
Concentration analysis under DORA Art. 29: clusters by service type and country, threshold findings, and single-point-of-failure detection across critical providers. The result is sealed as evidence.
Vendor questionnaires with real dispatch
Security questionnaires per vendor: templates, dispatch by email invitation, resending, and a no-login response portal. Every response stays tied to the vendor and the timestamp.
External security ratings on the vendor record
BitSight and SecurityScorecard integration: rating, grade and alerts appear directly on the vendor record — alongside criticality, contract term and concentration flag.
Prove once — credit across regimes
Vendor controls are cross-linked: one maintained register serves supply chain security under NIS2, third-party risk under DORA, and ISO 27001 A.5.19 at the same time.
From vendor list to sealed register.
Capture vendors & assets
Sync via integration or import via CSV — including automatic duplicate detection.
Assess risk
AI-assisted criticality classification, external ratings, and risk assessment following ISO 27005 or the generic 5×5 model.
Seal & export the register
The Register of Information and risk snapshots are versioned, sealed, and exported as CSV/XBRL.
A core building block for these regimes.
Supply chain security as one of the ten risk-management measures. Supply chain security is one of the ten minimum measures under Art. 21(2) NIS2 — the register provides the continuous evidence for it.
Regulation details →One register for vendors and risk.
We'll show you how your existing vendor data gets imported and classified in minutes.