TPRM (Supplier Shield)
Every supplier brings risks you inherit. Check each one at your pace.
TPRM in Acuna GRC keeps every supplier and vendor in one register, sends them questionnaires, rates their answers and watches their public security posture with a daily A to F grade. Aiko prepares the work, you confirm, and Swiss experts can do it with you.
Q4 supplier review
Campaign · Information security questionnaireHalden Freight AG
Assessment · In EvaluationQ14 · MFA for remote access
Suggested result: Partially Compliant. The policy covers VPN and admin consoles, but not the supplier's webmail.
Halden Freight AG
Assessment · 32 of 32 evaluatedThe problem
Why do supplier risk checks go stale? They run once a year, by email.
Most supplier checks still live in spreadsheets and inboxes, so they are out of date the day they are filed. Your suppliers hold your data and run your services, and their gaps become yours.
We email the same questionnaire every year and chase every reply by hand.
Fix: a campaign sends one questionnaire to many suppliers, now or on a date you schedule, with reminders before the due date and once overdue.
We only find out a supplier has slipped when they tell us.
Fix: daily scans of each supplier's public domain roll into an A to F grade, right on the register.
Every cycle starts from a blank page, and suppliers resend the same certificates.
Fix: completed answers pre-fill the next run of the same questionnaire, and the evidence library reuses certificates until they expire.
How TPRM works
How does third-party risk management work in Acuna GRC? From the first questionnaire to a rated supplier.
You send a questionnaire, the supplier answers in a portal, your evaluator rates the answers, and daily scans keep a grade on every supplier between checks.
How do you send one questionnaire to many suppliers?
With a campaign. Pick the contact for each supplier, edit the invitation email, then Send now or Schedule for later. The tracking board shows who has answered, and reminders go out before the due date and once overdue.
Answering questionnaires your customers send? That is Trust Center →Do suppliers need an account to answer?
No. Each contact gets a unique link to a portal with your logo. They answer each question, upload evidence, message your team on a single question and submit. Answers from their last submission are pre-filled and marked. They never see your evaluation.
How do you rate a supplier?
Mark every answer, then rate. The evaluator marks each answer Compliant, Partially Compliant, Not Compliant or Not Evaluated. Complete & Rate gives one to three shields, which become the supplier's actual rating. Attach findings turns shortfalls into findings with a severity and a recommendation.
How do you spot a supplier slipping between checks?
With a daily A to F grade on the register, next to each supplier's risk level, status and rating. Daily scans of the supplier's public domain cover DNS and email hygiene, TLS posture and web exposure, and roll into an A to F grade.
Breach history and sanctions checks depend on your subscription.
Breach and sanctions checks →Aiko in TPRM
How does AI help assess suppliers? Aiko does the prep work. You confirm.
Aiko drafts a supplier's answers from their own files and suggests a result for each question. A person confirms every one.
Swiss experts
Can someone evaluate our suppliers for us? Yes, our Swiss experts.
When you create an assessment, choose Acuna's Expert Team as the evaluator. It is a professional evaluation service: our experts evaluate the supplier's answers, and you review the result.
Cybersecurity governance expert
Jean-Emmanuel Rodriguez
Vendor risk and gap analysis
Auditing expert
Jean Munyarugerero
Management systems auditor.png&w=3840&q=75&dpl=dpl_AJy2pmbDKb49GsKiNiyrtJ2cfU31)
CEO of Acuna
Alexis Hirschhorn
Certified Lead Auditor
Do it yourself
You run the program in Acuna GRC, with Aiko.
Done with you
Guidance, reviews and audit preparation with your team.
Done for youOn TPRM
Our experts run it. You review.
Integrations
Does the TPRM software connect to the tools you already use? Yes.
Your procurement tool or CMDB can push suppliers in, and fixes sync with Jira or ServiceNow.
- Scheduled imports
Procurement or CMDB
Your system pushes a CSV of third parties. New ones are created and changed ones updated, matched on an External ID.
- API v1
Your own systems
Create and update third parties and their contacts with a scoped key. Every change is in the audit log.
- Tickets and tasks
Jira and ServiceNow
Tasks and tickets stay in step both ways with Jira and ServiceNow.
Jira
ServiceNow- 100+ connectors in all
Missing a connector? We build it. See Integrations and API
Connects with
How does TPRM fit with the rest of Acuna GRC? It shares one register.
Suppliers and third parties are one register in Implement, attached findings land in Assure, and Aiko answers questions about suppliers next to everything else.
- ImplementSuppliers share the third-party register
- OperateBIA criticality shows on each supplier
- AssureAttached findings live under Issues
- EvaluationsGap checks of your own organization
- Group managementHead office shares suppliers
- Staff PortalEmployees request new suppliers
- AikoDrafts answers, suggests results
- Integrations and APIImports and API keep suppliers current
FAQ
What else do people ask about TPRM software?
Which languages can questionnaires use?
English, German, French and Spanish. Each question carries its translations, and the emails at each stage of an assessment go out in the same four languages.
Can we use our own questionnaire?
Yes. Use a Default questionnaire as it is or clone it, build your own from scratch, or import one from CSV or XLSX. Each question has a category, a criticality and an Evidence required toggle.
How do you decide how risky a supplier is?
Each supplier gets an exposure band from your exposure model, by default Dependency and Penetration, each scored 1 to 3. You can define your own factors and bands. The overall conclusion is a risk level: High Risk, Moderate Risk, Tolerable or Not Identified.
Can employees ask for a new supplier?
Yes. Any employee fills in a short form in the staff portal. Reviewers approve the supplier as Tolerable, start an assessment from the request, or reject it with a response.
Can we track our suppliers' subcontractors?
Yes. Supply Chain records who a supplier delegates work to, with a delegation role and a DPA status, level by level.
What can we hand to auditors?
A supplier report as a PDF, covering identity, risk posture, the latest assessment, the latest OSINT scan and recorded findings, plus supplier and assessment lists as CSV and each assessment's results as CSV or PDF.
Do you replace our compliance team?
No. Aiko helps your team with the work, our experts add hands when you need them, and your people make the decisions.
Start with one step.
Show us one supplier list or one questionnaire. We'll show you a campaign, the supplier portal and Aiko's suggestions on it, and you confirm every result.
Hosted in Switzerland, the EU or the US