What is Supplier Sentry?
Supplier Sentry is a service for organisations that need a structured and scalable framework for managing information security risks in their supply chain. As more critical processes and systems are handled by external parties, the need for control and visibility into suppliers' security work increases.
Regulations such as NIS2 and DORA place clear requirements on organisations to demonstrate that they manage third-party risks in a systematic way. Supplier Sentry helps you meet these requirements and build a third-party risk management (TPRM) programme that is practical, proportionate and sustainable over time.
What Supplier Sentry can include
- Inventory and classification of suppliers based on criticality and risk exposure
- Design of frameworks and processes for ongoing supplier assessment
- Development of questionnaires and assessment criteria tailored to your requirements
- Conducting security assessments of selected suppliers
- Support in contractual regulation of security requirements towards suppliers
- Follow-up structure and escalation processes for gaps or incidents
The result is a living TPRM programme that gives you ongoing control and documented compliance with regulatory requirements and internal security policies.
When does Supplier Sentry fit?
Supplier Sentry suits organisations that have a significant dependence on external suppliers, cloud services or IT partners, and need to ensure these meet reasonable security requirements. It is particularly relevant for organisations subject to NIS2 or DORA, where supplier risk management is an explicit requirement.
The service also suits organisations that have recently experienced a supplier-related incident, are preparing for an audit or certification, or want to professionalise their current ad hoc approach to supplier assessments into a systematic programme.
How we work with Supplier Sentry
We start by mapping your supplier base and identifying which suppliers handle sensitive information, critical systems or important business processes. Based on a risk-based classification, we determine which assessment methods and requirement levels are appropriate for each supplier category.
We then build the structures, tools and processes so you can run the programme independently, with support from us when needed. We ensure the programme is proportionate to your organisation's size and resources, and that it is actually used in practice — not just exists on paper.