Third-party and vendor risk
See your suppliers' risk before it becomes yours
Your business relies on suppliers who hold your data or run your systems. This module watches their cyber risk from the outside and tells you when one changes.
See where you stand
Your suppliers' problems can become yours.
You cannot see their security
A supplier that holds your customer data may have weak security. You usually find out only when something goes wrong.
Questionnaires take effort
Sending and chasing supplier questionnaires is slow, and answers are only as good as the person who filled them in.
Clients and insurers ask
More clients and insurers want to know how you manage supplier risk. A list in a folder does not answer that.
What changes
From not knowing to watching.
First
Your important suppliers are listed with how much you depend on each one.
Then
Each supplier gets a rating, and the ones that need attention are clear.
Ongoing
You are alerted when a supplier's rating changes, and you can share a scorecard with the supplier showing what to fix.
How it works
How it works.
You list the suppliers that matterStart with the few who hold your data or run your systems.How this works underneath
Suppliers are recorded in a supplier register with their importance to your business. Reminders prompt reviews, and the register can be exported.We watch them from the outsideNo software to install and no forms for the supplier to fill in.How this works underneath
ratings come from Black Kite, which assesses organisations from outside using public and threat intelligence data. The platform shows the rating, how it is changing and the main findings.You act on what changesAlerts and scorecards turn findings into supplier conversations.How this works underneath
When a monitored supplier's rating changes, the platform can alert you. Scorecards present findings in plain language with suggested fixes that you can share with the supplier. Supplier findings can feed the risk register and board reports.
What it connects to
Supplier ratings from Black Kite.
We use Black Kite to rate your suppliers from the outside, so they do not need to do anything.
A small example
What this can look like.
- Situation
- The agency holds candidate records in a hosted system run by a supplier. A client asks how supplier risk is managed.
- What changes
- The supplier is added to the register and rated. Its rating has slipped since the last review.
- What happens next
- The agency shares a scorecard with the supplier and records the follow-up.
- What is kept
- The rating, the scorecard and the follow-up are kept as dated evidence.
This is an invented example to show how the module works. The names and figures are not a real customer's.
What is in it
What is in the supplier module.
Supplier register
The suppliers you depend on, with how important each one is and when it was last reviewed.
Supplier ratings
An outside-in rating for each monitored supplier, from Black Kite.
Change alerts
A notice when a monitored supplier's rating changes.
Scorecards
Plain-language findings with suggested fixes that you can share with the supplier.
Links to the rest of the platform
Supplier findings can appear in your risk register and your reports.
Questions
Common questions.
No. Ratings come from outside, using public and threat intelligence data. Suppliers do not install software or complete questionnaires.
Control 4.9.0.1, a digital trust programme with suppliers, applies at Diamond. Supplier monitoring also helps answer client and insurer questions at any level.
From Black Kite, a technology partner of CyberGrape. We show the rating and findings. We do not repeat the provider's own marketing claims.
Related
Works with.
See your supplier risk.
The free readiness assessment shows you where you stand and what to fix first. If we are not the right fit, we will tell you that too.