Third-party risk management software
Tier every supplier, send the vendor security questionnaire by secure link, decide on the evidence with two people, and keep watching each vendor's external posture between assessments.
- Module typeOperational workspace (product module)
- TieringTier 1 Critical, Tier 2 Important, Tier 3 Standard, recommended from five criteria
- Questionnaire24 questions in six domains: 24 for Tier 1, 16 for Tier 2, 8 for Tier 3
- LifecycleInitiation, tiering, assessment, risk decision, contracting, monitoring, offboarding
- MonitoringDaily for critical and Tier 1 vendors, every 3 days for high, weekly otherwise
- OutputAssessment reports in PDF and Word, register CSV, posture history
What third-party risk management covers
Who it applies to
- Procurement, vendor management and third-party risk teams running supplier due diligence
- Banks, insurers and payment firms evidencing outsourcing and service provider oversight under SAMA, APRA CPS 230, DORA or MAS
- Government entities and critical infrastructure operators meeting NCA ECC third-party and cloud controls
- Organisations replacing spreadsheet questionnaires and evidence collected by email
- Security teams that need a vendor's exposure watched between annual reviews
Third-party risk management (TPRM) is knowing which suppliers can hurt you, how badly, and whether the controls they claim are real. Almost every framework GRCLens carries asks for it: the third-party and cloud domain of NCA ECC, the Third Party Cyber Security domain of the SAMA Cyber Security Framework, the supplier controls of ISO/IEC 27001, the material service providers of APRA CPS 230, the ICT third-party risk of DORA and the supply-chain measure of NIS2.
The Supply Chain / Vendor Assessment workspace keeps the lifecycle on one record: a vendor register with tier, criticality, data shared and contract dates; a questionnaire whose depth follows the tier; evidence the vendor uploads through a secure link; a recorded decision; and monitoring until the vendor is offboarded. Depth follows inherent risk, and a certificate or a commercial argument alone never reduces it.
Monitoring is evidence, not a verdict. A scheduled scan scores each vendor's external posture, keeps a snapshot of every scan and raises an alert when a new high or critical finding appears or the score drops sharply. It never changes the vendor's risk rating: a person does that, with the monitoring history in front of them.
Related reading: One supplier assurance programme for APRA CPS 230, MAS, HKMA, SAMA and the CBUAE; Third-party and cloud risk under GCC frameworks
How GRCLens supports Third-Party Risk Management
Vendor assessment runs beside your framework assessments in GRCLens, so each supplier's questionnaire answers, evidence decisions and monitoring history stay in one auditable record.
Vendor register and tiering
Each vendor carries category, tier, criticality, owner, data classification, data shared, contract dates and review dates. Five criteria (data access, system access, operational dependency, substitutability and regulatory exposure) recommend the tier, and contracts ending within 90 days are flagged.
Vendor security questionnaire by link
The questionnaire reaches the vendor as an emailed link that expires after 30 days and accepts one submission; only a hash of the token is stored. Vendors upload certificates and evidence through the same link without a GRCLens account. Questions can be added from a spreadsheet template or extracted from an existing questionnaire document.
Evidence decided by two people
Baseerah rates each uploaded file for relevance and confidence, and a reviewer decides. The person who uploaded a file can never approve it, a rejection needs a reason, and the decision trail is append-only, so it outlives the file it describes.
Assessment summary and decision
Answers score Yes 2, Partial 1 and No 0, with not applicable left out, and band the vendor Low, Medium, High or Critical. An AI-drafted summary proposes approve, approve with conditions or reject with prioritised actions; analysts comment, compare with the previous assessment and export the report in PDF or Word.
Continuous vendor monitoring
Scans check published breaches, the certificate transparency footprint, SPF and DMARC, TLS expiry, HSTS and other security headers, and security.txt, with no API keys to manage. Each scan writes a snapshot with a score and an A to F grade, and a vendor never scanned shows as not scanned, never as zero.
Alerts that never re-rate
A new high or critical finding, or a drop of 10 points or more, raises a notification to review the vendor. Automation never changes the risk rating, and the third-party indicator for vendors below the minimum cyber threshold reads the worse of the questionnaire score and the external score.
Engagements with gates
Each engagement runs seven stages from initiation to offboarding. Four stages are gated, each gate needs a named approver, and the decision is approved, conditional approval or rejected, with 14 SLA definitions and modular assessments for cloud, SDLC, privileged access, personal data, integration, operationally critical services and AI.
Procurement intake
Coupa, SAP Ariba, ServiceNow, Jaggaer or any system that can post JSON from a workflow step opens engagements through a keyed intake connector. No SLA clock starts until a person confirms the engagement is in scope and complete.
Third-party KRIs and KPIs
18 key risk indicators and 12 key performance indicators, from open high-risk findings, overdue reassessments and expired assurance artefacts to monitoring coverage gaps, alongside a dashboard of active, high-risk, unassessed and overdue vendors and expiring contracts.
Third-Party Risk Management frequently asked questions
What is third-party risk management software?
Software that runs supplier risk as a lifecycle: register and tier vendors, assess them with questionnaires and evidence, record a decision, and monitor them until offboarding. In GRCLens it is the Supply Chain / Vendor Assessment workspace, on the same platform as the framework assessments that ask for it.
Is this vendor risk management software or a TPRM platform?
Both names describe the same work. GRCLens uses the vendor register and questionnaire for day-to-day vendor risk management, and governed engagements with gates, SLAs and a recorded risk decision for third-party risk management; both live in the same workspace.
How does the vendor security questionnaire reach the supplier?
By an emailed link that is valid for 30 days and accepts one submission. The supplier answers and uploads evidence without a GRCLens account, the token is checked before anything submitted is read, and only a hash of it is stored.
Does continuous vendor monitoring change a vendor's risk rating?
No. Monitoring scores the vendor's external posture, keeps a snapshot of every scan and raises an alert on a new high or critical finding or a drop of 10 points or more. Changing the risk rating is left to a person, with the history in front of them.
How often are vendors monitored?
Vendors rated Critical or placed in Tier 1 are scanned daily, High every three days, and everyone else weekly, from a scheduled job that runs at 03:30 UTC.
Can the same person upload and approve vendor evidence?
No. Only reviewers and administrators decide on evidence, the person who uploaded a file can never approve it, and a rejection needs a reason. Every decision is written to an append-only trail that copies the AI opinion the reviewer saw.
Which frameworks does third-party risk evidence support?
Third-party controls appear in NCA ECC, the SAMA Cyber Security Framework, ISO/IEC 27001, APRA CPS 230, DORA, NIS2 and MAS technology risk guidance, among others. Vendor assessment reports, decisions and monitoring history are the records those controls ask for, and can be attached as evidence in the framework assessment.
Talk to us about Third-Party Risk Management
Security Solution Consultants provides third-party risk management advisory alongside the platform, so you can combine tooling with hands-on expertise.