How it works
Six steps from your supplier list to a signed report you can show the regulator.
How we assess your suppliers
- 01.
Send your list.
As it is, with what each supplier does for you.
Send us your supplier list in any format: a spreadsheet, an export from your finance system or a simple email. Tell us briefly what each supplier does for you. That is all we need to get started.
- 02.
We set the risk tier.
Low, Medium or High, based on the data a supplier gets and how long you can do without it.
We ask two questions per supplier: what data does it get from you, and how long can you keep working without it. The answers put every supplier in Low, Medium or High, each with its own set of requirements.
- 03.
We research.
Trust pages, certificates and privacy terms, every answer with its source.
AI searches trust centres, certificate registers, privacy statements and sub-processor lists. Every answer is stored with the link and date of its source, so you can always trace it back.
- 04.
We collect evidence.
We request what is not public and follow up with the supplier.
For Medium and High suppliers we request the evidence that is not public, such as SOC 2 reports or penetration test summaries. We send the request, chase it and keep track of what comes back.
- 05.
We assess.
Each requirement for the tier marked met or not met, mapped to NIS2 and ISO 27001.
A security expert checks every requirement for the tier against the evidence and marks it met or not met. Each requirement is mapped to NIS2 and ISO 27001, so your auditor sees where it fits.
- 06.
You get a signed report.
Plus a supplier register and clear options for any gaps.
You receive a signed report per supplier, an up-to-date supplier register and, for every gap, clear options to decide on. Everything is ready to share with management or the regulator.
Risk tiers
Every supplier gets a tier from two questions: what data the supplier gets from you (none, anonymised, identifiable personal data, or confidential business data) and how long you can keep working without it. Low, Medium and High each have their own set of mandatory requirements.
Evidence we review
- ISO 27001 certificates (scope and validity)
- SOC 2 Type II reports (period, auditor opinion, exceptions)
- Penetration test summaries (date and follow-up)
- NIS2 Cyber Score
- NIS2 Supply Chain certificates (SC10, SC20, SC30)
- Privacy terms and sub-processor lists
Suppliers that use AI
An extra review of how the supplier governs its AI and whether your data is used to train models.
When a supplier falls short
You receive a ready-made risk entry with options: accept the risk, ask the supplier to fix it, or add your own controls. Your management decides.
Frequently asked questions
Do we fall under the Cyberbeveiligingswet?
It depends on your sector and size. Most organisations in a listed sector with 50 or more employees, or more than 10 million euros in turnover and balance sheet, fall under it. The NCSC offers a self-check, and we are happy to look at it with you.
What if a supplier does not respond?
We assess what is publicly available and record the missing response as a finding, so you can still show what you did.
Do you take over our responsibility?
No. You stay responsible under the law and you make the final decision. We do the work and give you a signed, documented advice.
How do you use AI?
AI researches and drafts. A security expert checks every answer and signs every report. [Your data is never used to train AI models.]
Which suppliers should we assess first?
Start with suppliers that hold your data or that you cannot work without for more than a day. We help you sort your list into tiers.
Ready for a supplier file you can defend?
Let's get started.