Third-party risk
See supplier risks before they land on you
Not a hundred-page report. A short list of what could hurt you, including the suppliers you depend on, and what to do about each.
Who it is for
Who this is for.
Businesses that depend on suppliers and cannot easily see their risk.
Suppliers hold your data
Software, hosting and payroll providers hold some of your data, and you cannot see how well they protect it.
Clients ask about suppliers
Larger customers want to know how you manage supplier risk, and a folder of contracts does not answer it.
Working towards Diamond
SMB1001 control 4.9.0.1, a digital trust programme with suppliers, applies at Diamond.
What changes
From unseen to ranked.
First
Your risks and your most important suppliers are written down, ranked and given owners.
Then
Critical suppliers are monitored from the outside. Findings from your connected tools are ranked alongside your other risks.
Ongoing
You get early warning when a supplier's exposure changes, with scorecards to share with the supplier.
How it works
How it works.
We set up your register and supplier listThe few suppliers who matter most go first.How this works underneath
Risks are scored on a five by five likelihood and impact grid that can be adjusted. A business context assessment can suggest risks for you to review. Suppliers are held in a supplier register.Black Kite watches your suppliersFrom the outside, so suppliers do nothing.How this works underneath
ratings come from Black Kite, using public and threat intelligence data. We show the rating and findings, not the provider's own marketing claims.You act on what changesFindings become tracked actions.How this works underneath
Findings and treatments become tasks in the Action Hub with owners and dates, and appear in your reports.
What it connects to
Supplier monitoring with Black Kite.
Black Kite rates your suppliers from the outside. CyberGrape connects it to your risk register and reports.
A small example
What this can look like.
- Situation
- The agency holds candidate records in a hosted system run by a supplier.
- What changes
- The supplier is added and monitored. Its rating has slipped since it was first listed.
- What happens next
- The agency shares a scorecard with the supplier and tracks the follow-up as an action.
- What is kept
- The rating, scorecard and follow-up are kept with dates.
This is an invented example to show how the service works. The names and figures are not a real customer's.
What you get
What you get.
A live risk register
Ranked by what an incident would cost you, with owners and treatment plans.
Continuous supplier monitoring
Outside-in ratings, with no questionnaires to chase.
Findings from your connected tools
Ranked alongside your other risks.
Early warning on supplier changes
Alerts when a monitored supplier's exposure changes.
Reports for owners and boards
Plain-language reports from your live data.
Questions
Common questions.
A written list of the things that could harm your business, each with a rating, an owner and a plan. In CyberGrape it is live in the platform.
No. Ratings come from outside, using public and threat intelligence data. Suppliers do not install anything or fill in a questionnaire.
Control 4.9.0.1, a digital trust programme with suppliers, applies at Diamond. It also helps answer client and insurer questions at any level.
Yes. The likelihood and impact scales and the thresholds for low, moderate, high and extreme can be adjusted.
Other services
Also available.
See your risks and your suppliers' risks.
Start with the free readiness assessment. It shows you where you stand, and we will tell you which service, if any, makes sense.