CyberGrape – cyber security certification and GRC platform for small business

Supply chain and vendor risk

Know which suppliers matter, then keep watch

Supply chain risk starts with knowing who your suppliers are and how much you depend on each. This page covers the supplier register and the record it builds.

See where you stand

Most businesses cannot list their suppliers.

No complete list

Software, hosting, payroll and advisers each hold some of your data. Few businesses have all of them in one place.

No sense of what matters most

A tool used by one person is not the same as the system that runs every invoice. Without a ranking, everything gets equal attention, or none.

Nothing to show when asked

When a client or insurer asks how you manage suppliers, there is no dated record to hand over.

What changes

From a guess to a record.

  1. First

    Every supplier is listed once, with what it does for you and what data it holds.

  2. Then

    Suppliers are ranked by how much you depend on them, and the ones that matter are monitored.

  3. Ongoing

    Reviews are prompted on a schedule and the record stays current.

How it works

How it works.

  1. Build the registerOne list of suppliers, with an owner for each relationship.How this works underneath
    Each supplier entry holds what the supplier does, the data it handles, the person who owns the relationship and the date of the last review. Staff in your business can be reminded when reviews are due.
  2. Rank and monitorSpend attention where the dependence is greatest.How this works underneath
    Critical suppliers can be monitored through Black Kite for outside-in ratings and change alerts. The supplier risk page explains how monitoring works.
  3. Keep the recordReviews, ratings and follow-ups are kept with dates.How this works underneath
    The supplier register can be exported. Findings can feed the risk register, and supplier information appears in your when a client or insurer asks.

What it connects to

Monitoring with Black Kite.

Critical suppliers can be rated from the outside, with no forms for the supplier to complete.

All technology partners
  • Black Kite logo

A small example

What this can look like.

SampleA design studio lists its suppliers
Situation
The studio has eleven suppliers in people's heads and in old emails.
What changes
All eleven go into the register. Three are marked critical because they hold client files or run payments.
What happens next
The three critical suppliers are monitored and reviews are scheduled.
What the owner can say
"Here is every supplier, how much we depend on it and when we last checked."

This is an invented example to show how the module works. The names and figures are not a real customer's.

What is in it

What is in the module.

Supplier register

Suppliers, what they do for you, the data they hold and who owns each relationship.

Review reminders

Prompts so supplier reviews happen on a schedule.

Supplier ratings

Outside-in ratings for the suppliers you choose to monitor, from Black Kite.

Export

The register can be exported when a client, insurer or auditor asks for it.

Questions

Common questions.

Start with your supplier list.

The free readiness assessment shows you where you stand and what to fix first. If we are not the right fit, we will tell you that too.