Vendor risk register
List your suppliers, rate what they can reach, run a short security questionnaire and get a risk level, a review date and an audit-ready PDF. Everything stays in your browser.
| Vendor | Service | Risk | Questionnaire | Next review | Contract end |
|---|
No vendors yet. Start with the suppliers that can reach personal data or keep your core service running.
Vendor details
Security questionnaire
Answer from the vendor's documentation, certificates or their completed questionnaire.
Unlimited vendors
The free version holds up to 3 vendors and adds a small gofirmhub line to the PDF. With a subscription there is no limit, and you can put your company name on the audit PDF.
Backup
Your register lives in this browser only. Download a backup regularly; restore it on another device.
Runs entirely in your browser. Vendor data is not uploaded to a server.
Why supplier risk matters under NIS2 and GDPR
NIS2 lists supply chain security among the minimum cybersecurity risk-management measures (Article 21(2)(d)): the security aspects of the relationship with each direct supplier and service provider. Article 21(3) adds that you must take into account the vulnerabilities specific to each of them, the overall quality of their products and their cybersecurity practices, including secure development.
GDPR lets you use only processors that provide sufficient guarantees of appropriate technical and organisational measures (Article 28(1)), and requires a contract with each processor that sets out the processing (Article 28(3)). That is the data processing agreement this register tracks.
DORA requires financial entities to keep a register of information on all contractual arrangements for ICT services from third-party providers (Article 28(3)), in a format set by the supervisory authorities. This tool does not produce that format, but the same assessment work feeds into it.
Sources: NIS2, Directive (EU) 2022/2555 · DORA, Regulation (EU) 2022/2554 · GDPR, Regulation (EU) 2016/679
How to build your register in an afternoon
- List every supplier that can reach your data or your systems, or that you cannot work without: start with your accounts payable list and your single sign-on or admin console.
- For each one, fill in what they can access and how bad an outage would be. That gives the inherent risk.
- Answer the questionnaire from their security page, certificates, contract and data processing agreement. Ask the vendor for what is missing.
- Fix the findings: ask for multi-factor authentication, sign the data processing agreement, add an incident notification clause at renewal.
- Download the audit PDF, add the reminders to your calendar and repeat the assessment on the review date.
Related tools
Check your overall readiness with the free NIS2 checklist and ISO 27001 checklist, or get the editable policies and templates in the NIS2 toolkit.
How the risk level is calculated
1. Inherent risk is what could go wrong before you look at the vendor's controls. Add up:
- Access to your data: None = 0, Internal business data = 1, Personal data = 2, Sensitive or special-category data = 3
- Access to your systems: None = 0, Limited user access = 1, Privileged or admin access = 2
- Impact if the vendor fails: Low: easy to work around = 0, Medium: some disruption = 1, High: key process stops = 2, Critical: core service stops = 3
- Where the data is processed: EU / EEA = 0, Country with an EU adequacy decision = 1, Other country = 2
0–2 points is Low, 3–4 Medium, 5–7 High and 8–10 Critical.
2. Questionnaire score. Yes counts 1, Partly 0.5 and No 0; N/A is left out. The score is the average as a percentage. A score of 85% or more lowers the level by two steps, 60–84% by one step, and below 40% raises it by one step. Without answers the level stays at the inherent risk.
3. Findings. A "No" on a key control (multi-factor authentication, encryption, incident notification), or a missing data processing agreement while the vendor processes personal data, is listed as a finding in the register and the PDF.
4. Review dates. Suggested intervals: Low every 24 months, Medium every 12 months, High every 6 months, Critical every 3 months. Contracts that end within 90 days are flagged.
These are practical defaults, not a legal standard. Adjust them to your own risk policy and document that choice.
Frequently asked questions
What is a vendor risk register?
A list of the suppliers and service providers your business depends on, with what they can access, how important they are, how well they protect your data and when you last checked them. It is the starting point for third-party or supply chain risk management.
Does NIS2 require a vendor risk register?
NIS2 does not prescribe a specific register, but Article 21(2)(d) requires supply chain security as one of the minimum cybersecurity risk-management measures, and Article 21(3) says entities must take into account the vulnerabilities and cybersecurity practices of each direct supplier and service provider. A register with a documented assessment per supplier is a practical way to show that you did this.
Is this the DORA register of information?
No. Financial entities under DORA must keep a register of information on all contractual arrangements for ICT services (Article 28(3)), in the format set by the European supervisory authorities. This tool helps you assess and track ICT suppliers, but it does not produce that official register format.
Where is my data stored?
Only in your browser on this device. Nothing you enter is uploaded. Use "Download backup" regularly and "Restore backup" to move the register to another device or browser.
How is the risk level calculated?
First the inherent risk: points for data access, system access, business impact and location. Then the questionnaire score lowers or raises that level. The exact rules are shown on this page, so you can explain every score to an auditor.
What does the free version include?
Everything, for up to 3 vendors. The PDF then carries a small gofirmhub line. A subscription removes the limit and the line.
This tool helps you organise and document supplier risk. It is not legal advice and does not by itself make you compliant with NIS2, DORA or GDPR.