Know the risk of every supplier and when to review it
Your suppliers hold your data, run your systems and talk to your customers. Qalea keeps one register of every supplier with an owner, the departments that use it, the personal data it handles, its risk level and criticality, and the date of its next review, so you always know which suppliers need attention before the next audit.
Supplier risk is part of your own risk
When a supplier has an incident, your customers see it as yours. Most companies track suppliers in a spreadsheet built for the last audit, with no owner per supplier, no record of who handles personal data and no date for the next review.
Nobody owns the supplier
Every supplier has a responsible person and the departments that use it.
Nobody knows who handles personal data
Each record states the type of personal data the supplier manages.
Reviews only happen when the auditor asks
Each supplier has a last review date, a next review date and a status, so pending reviews show before the audit.
One record per supplier, with what an auditor asks for
Each supplier gets its own record. It shows who owns the relationship, which departments use the service and what kind of personal data the supplier handles.
The record also shows how risky the supplier is and how critical it is to your business, along with its security certification or questionnaire and its current compliance status.
When a review is due, the contact, the contract and the last review are all in one place. You record what you found and set the next review date, and the register keeps track of everything still pending.
Already keep your suppliers in a spreadsheet? Import the list in bulk, and export the register as CSV whenever you need it.
The supplier review cycle
Every supplier follows the same four steps, so each review happens on a date you set.
Register
Add suppliers one by one or in bulk, each with an owner.
Classify
Rate risk level and criticality, and record the personal data each one handles.
Review
Check certifications, contract and findings, and record the outcome.
Repeat
Set the next review date. Pending reviews stay visible in the register until they are done.
One register for the supplier controls in every framework
ISO 27001
Information security in supplier relationships, supplier agreements, the ICT supply chain and the monitoring and review of supplier services (Annex A 5.19 to 5.22).
ENS
External services: contracting and service agreements, daily management and supply chain protection (op.ext.1 to op.ext.3).
SOC 2
Assessment and management of risks from vendors and business partners (CC9.2).
NIS2
Supply chain security, including the security of relationships with direct suppliers and service providers (Article 21).
DORA
Management of ICT third party risk and of contractual arrangements with ICT service providers (Articles 28 to 30).
Supplier risk questions, answered
Keep learning about supplier risk
