A breach at your vendor is still your breach

Regulators and customers no longer accept the excuse that a failure happened at a supplier. Under frameworks from ISO 27001 to the DPDP Act, you remain accountable for the data you hand to processors and vendors. Yet most organisations cannot produce a current vendor inventory, let alone evidence of due diligence. A third-party risk program turns that blind spot into a managed, auditable process. We build it from inventory to contract.

This suits any organisation with material supplier dependencies or processor relationships under audit scrutiny.

How we work

Inventory and tier. We catalogue every vendor and tier them by data access, criticality, and the risk they carry.
Diligence. Each tier gets a calibrated due-diligence questionnaire, so effort matches exposure.
Contract. We review and strengthen security, data-protection, and breach-notification clauses before you sign.
Monitor. A reassessment cadence keeps high-risk vendors under continuous review, not a one-time check.

Defensible to your auditor and regulator

The program produces a living register, governance reporting, and an evidence trail — so when an auditor or regulator asks how you manage supplier risk, you have an answer that holds.