A register your auditor can read
Vendors tiered, sub-outsourcing chains mapped, criticality justified. The artifact the auditor opens at the start of fieldwork and finds what they expect.
Third-party risk management
A vendor programme that survives procurement growth.
One register, one tiering rule, one contractual baseline. Built so the security team is no longer the bottleneck on new vendor signups, and the auditor, the regulator and the enterprise customer all get the same coherent answer.
- One register that answers SOC 2, ISO, DORA and NIS2 without duplicating effort.
- Tiering rule that stops over-reviewing low-risk SaaS and under-reviewing the critical few.
- Contractual baseline procurement actually uses, not a clause library that nobody reads.
- SOC 2 CC9
- ISO 27001 A.5.19-23
- DORA Article 30
- NIS2 supply chain
When this is for you
The moments vendor risk becomes a board item.
-
An auditor flagged your vendor programme as immature.
The questionnaires you sent out twelve months ago are stale, the contracts predate your security obligations, and there is no register the auditor can examine. The finding is on the file and the next audit is coming.
-
A subprocessor of a subprocessor had a breach.
You spent two weeks tracing whether you were affected and what to tell customers, because the sub-outsourcing chain was never mapped. The next incident will be worse if the visibility is not built.
-
Procurement is signing tools faster than security can review them.
The team needs the tools. Blocking is not the answer. A tiering rule plus a lightweight self-attestation path lets the low-risk long tail through without exposing the company to the items that should have been caught.
-
DORA brought "critical ICT third-party providers" into your contract language.
Article 30 mandatory clauses, exit strategies, sub-outsourcing transparency, data localisation. The contracts you have today almost certainly do not meet the standard, and the financial-entity customer is asking.
The engagement
Four phases. One programme, multiple audiences.
The programme is one. The artifacts it produces serve the auditor, the regulator and the enterprise customer at the same time.
- 01
Inventory & tiering 2–3 weeks
A complete vendor inventory pulled from finance, IT, procurement and the shadow stack. A tiering rule applied: critical, sensitive, standard, low-risk. A register populated in the format the most-demanding stakeholder requires, typically DORA Article 30 or SOC 2 CC9.
- 02
Assessment baselines 3–4 weeks
A questionnaire that scales with tier, not the same 250-question pack for every signup. A review workflow with named owners, SLAs and escalation. A documented decision standard so "we accepted the risk" becomes a defensible position.
- 03
Contractual baseline & remediation 3–6 weeks
Standard clauses drafted with your legal counsel, mandatory clauses for regulated relationships layered on top, and a remediation programme for the in-flight contracts that fail the baseline. Procurement uses the same starting position for every new deal.
- 04
Ongoing review cadence embedded
Annual review for critical vendors, biennial for sensitive, event-driven for the rest. Triggered re-reviews on incident, ownership change, or contract renewal. The programme runs on a calendar your team owns, not a panic before each audit.
Outcomes
What the register answers on demand.
A tiering rule procurement can apply
Low-risk SaaS gets through quickly. Critical providers get a real review. The security team stops being the bottleneck for the wrong reasons.
Contracts that meet the standard
Baseline clauses adopted, regulated-relationship clauses layered on top, and a remediation track for the contracts that did not previously meet the bar.
A cadence that survives audit week
Reviews happen on a calendar, not in a fire drill. The next audit is a snapshot of the working programme, not a one-off cleanup project.
From the practice
"Most vendor incidents are not surprises, they are predictable from a register nobody maintained. The programme that does the boring continuous work is the one that does not produce the bad surprise."
Purple Dragon Cybersecurity
Frequently asked
Common questions, direct answers.
How is this different from a vendor questionnaire spreadsheet?
A spreadsheet is the artifact, not the programme. The programme is the rhythm: how new vendors get onboarded, how existing ones get re-reviewed, who owns the decision when a vendor scores poorly, and how procurement knows which contractual clauses are non-negotiable. We build the programme, then automate as much of the artifact as your stack supports.
Do we need a TPRM tool to do this well?
Not at the start. Most startups under 200 people are best served by a structured workflow in tools they already pay for (Notion, Linear, Drive, Drata or Vanta). Dedicated TPRM platforms earn their place when the vendor count crosses a few hundred or when a regulator like DORA forces a specific format. We will tell you, plainly, when you have crossed that line.
How does this tie back to SOC 2, ISO 27001, DORA or NIS2?
SOC 2 CC9 and ISO 27001 Annex A.5.19 to .5.23 both require a vendor management programme. DORA Article 28-30 raises that to a binding register in a specific format for financial entities. NIS2 pushes supply-chain controls down through the customer chain. We build one programme that answers all of them, not parallel artifacts that drift.
What does the contractual baseline look like?
Standard clauses on confidentiality, security obligations, breach notification, sub-processor transparency, audit rights, data localisation, and exit. For DORA-relevant vendors, the Article 30 mandatory clauses on top. We draft the baseline, your legal counsel adopts it, and procurement uses it as the starting position for every new contract.
What about the long tail of low-risk SaaS the team signs up for?
We build a tiering rule: a lightweight self-attestation path for low-risk tools that handle no sensitive data, a fuller review for anything that touches customer data, infrastructure or payment flows, and a board-level review for a small number of critical providers. Most of the spend is in tier three; most of the risk is in tier one. The programme reflects that.
Get a 30-min vendor-programme review
A working session on the state of your vendor programme, what needs to move first, and what a realistic 90-day plan looks like.
Talk to a security operator.
Tell us what you're trying to ship, what's stalled, or which buyer security review is up next. We work with companies across the EU, EEA and US, and we reply within one business day.
- info@purpledragoncyber.com
- +31 10 899 8719
- Nicolaas Beetsstraat 216, 3511 HG Utrecht