Suppliers

NIS-2 holds you responsible for the security of your supply chain, not just your own systems. turingsecure gives you a third-party risk register: tier each vendor by risk, run due-diligence questionnaires, and link the contracts and data-processing agreements that govern them. This is the risk register. The link between an asset and who supplies it lives in Asset Management.

Know Your Third-Party Risk

One Register for Every Vendor Relationship

Regulators no longer accept a supplier list in a spreadsheet. NIS-2 expects you to know which third parties carry real risk, to have checked them before you rely on them, and to have the contractual terms that make security enforceable.

turingsecure keeps every supplier in one register. Each vendor carries a risk tier, the due-diligence questionnaire you sent them, and links to the contract and data-processing agreement that govern the relationship. When an auditor asks how you manage supply-chain risk, the answer is a single, current record rather than a scramble across departments.

Supplier register with risk tiers, questionnaires and linked contracts

What the Module Does

Register, Tier, Assess, Contract

Vendor Register: Keep every third party and vendor in one place with its contacts, services and the data or systems it can reach.
Risk Tiering: Rate each supplier by the risk it carries, so due diligence and oversight go where the exposure actually is, not evenly across the list.
Due-Diligence Questionnaires: Send security and privacy questionnaires, collect the responses against the vendor, and keep them as dated proof that you checked.
Contracts and DPAs: Link the contract and the data-processing agreement to each supplier, so the terms that make security enforceable are never lost.