Vigilance360 TPRM
Know every vendor. Prove every decision.
Every vendor that touches your data goes through one process, from first request to board report.
The problem
Three places where the vendor record usually breaks.
No single vendor list.
Procurement, IT and business units onboard suppliers their own way. Some vendors are onboarded twice and others are never reviewed.
Answers without evidence.
A vendor ticks “yes” and nobody checks the policy or certificate behind it. The rating set at signing never changes.
Exceptions that never close.
Risks are accepted in email with no owner and no end date. When the regulator asks, the record is rebuilt from inboxes.
Features
What is inside.
Third-party risk, from intake to board report.
Intake and deduplication.
One request form for every business unit. Matching on name, domain and tax ID stops the same vendor being added twice.
Tiering and scoped questions.
Data access, network access and service type set the tier, and the tier decides which questions the vendor gets.
Vendor portal.
Vendors answer, upload evidence and see their own open items. Reminders go out without anyone sending them.
Outside-in scan.
Email, web and certificate checks on the vendor's domain, run on request, to compare with what the vendor told you.
Findings with owners.
Each gap becomes a finding with an owner and a due date, and stays open until the fix is evidenced.
Risk acceptance with an expiry.
Accepting a risk needs an approver and an end date. When the date passes, it comes back for review.
Maker and checker.
Tier changes, acceptances and closures need a second person. Each approval is logged with who, when and why.
Scheduled reassessment.
High-risk vendors are reassessed every year. Expiring certificates and contracts are flagged before they lapse.
Board and regulator reports.
Vendor count, tier mix, open findings and overdue reviews, drawn from the record the team works in.
The standards you answer to.
- RBI outsourcing and IT guidelines
- SEBI CSCRF
- ISO 27001
- SOC 2
- PCI DSS
- DPDP Act
- NIST CSF
Also in the suite
Use one, or all three.
They share the same approvals, audit trail and reports, so adding one later does not mean starting over.