Third-party risk
Every supplier, from the day it is taken on to the day it leaves.
Eurus keeps each supplier's life with the business: the security questionnaire and its result, a risk level that names every point it rests on, the contract's end, the next review, what went wrong at it, and, when it leaves, the confirmation that the data was returned or deleted.
What the law asks about suppliers
GDPR
A business uses only processors that give sufficient guarantees (Article 28(1)), under a contract that, among other terms, has the data returned or deleted when the service ends (Article 28(3)(g)).
DORA
A financial entity manages ICT third-party risk as part of its ICT risk framework, keeps a register of information on every ICT contract (Article 28), puts Article 30's terms in each contract, and has exit strategies for the providers behind critical or important functions.
NIS2
The cybersecurity measures of Article 21(2)(d) include supply chain security: the security of each direct supplier and service provider.
ISO/IEC 27001
Annex A's controls 5.19 to 5.22 cover supplier relationships: security in supplier agreements, the ICT supply chain, and monitoring and reviewing suppliers' services.
The supplier's life, kept
Taken on with an assessment
A supplier that handles personal data or IT, taken on with no security questionnaire sent, is raised. One sent and unanswered after 30 days is chased.
A risk level with its reasons
Low, medium or high, read from what is on record: a critical function, personal data and where it is kept, the processing agreement, the questionnaire's result, open incidents, a lapsed contract. Every point is said in words.
Contracts watched
A contract's end is raised 60 days out, and as ended once past while the supplier is still in use.
Reviews on an interval
Every 12 months for a high-risk supplier, 24 for medium and 36 for low, unless a date is set by hand.
Incidents at the supplier
Recorded and kept open until closed with the outcome. One that touched the business's personal data is raised as a possible breach of its own to assess, under GDPR's 72 hours.
Let go cleanly
A processor leaving needs written confirmation that the data was returned or deleted, recorded with who checked it.
Try this in a copy of your own, for two hours, with nothing to sign up for.
Open your own copyOn the registers it already keeps
The supplier register joins the GDPR processors and the DORA IT suppliers by name, with subprocessors per supplier. What is due for a supplier is listed in Issues like any other problem, and the DORA register of information is kept in the Commission's template columns.
Want it on your own systems?
We start with an audit: how your operations really run, mapped to the controls you keep.