Services
Run for you.
Built with you.
Owned by you.
A managed service, expert consultancy, or a capability built into your own estate.
Choose one or combine them, always covering both directions of your supply chain.
What we do
Three ways to work with us.
← WE RUN IT
YOU OWN IT →
Run for you.
We operate it for you.
Built with you.
We build it alongside your team.
Owned by you.
It runs in your estate, licence-free.
01 / 03
Run
for you.
We operate your third-party risk programme, audits and customer assurance, so your people don’t have to.
WHO DOES THE WORK
SUPPLY ASSURE
YOUR TEAM
We do the work. You make the decisions.
Ask about managed services
01 · MANAGED SERVICE
Managed third-party risk
We become your third-party risk function. Our analysts run the tooling so your people don’t have to.
Tiered inventory, including suppliers procurement never listed
Always-on monitoring, triaged before it reaches you
Monthly reporting and a quarterly board summary
SUPPLIER INVENTORY
Corvane Payroll
T1
Helix Cloud
T1
Northgate Logistics
T2
Brightwell Print
T3
+12 suppliers procurement never listed
02 · ASSESSMENT
Audits and assessments
ISO 27001 Lead Auditors test the controls that matter, remote or on site, when self-attestation isn’t enough.
Scope agreed with you and the supplier
Graded findings with remediation timescales
Follow-up verification once fixed
FINDING 03 · GRADED
Shared admin account
HIGH
Evidence: access logs, 3 client tenants
Remediate within 5 days
Verified on follow-up
03 · SUPPLIER-SIDE
Customer assurance
When you are the supplier, we build your evidence once and keep it verified, so questionnaires stop costing you deals.
A reusable, verified assurance profile
Questionnaires drafted and checked by practitioners
Customer audit preparation and support on the day
ASSURANCE PROFILE
Verified · current
ISO/IEC 27001 certificate
Cyber Essentials Plus
Penetration test summary
Data protection controls
Shared with 14 customers
02 / 03
Built
with you.
Senior practitioners alongside your team to assess, design and de-risk.
WHO DOES THE WORK
SUPPLY ASSURE
YOUR TEAM
We bring the expertise. Your team owns the outcome.
Ask about consultancy
04 · CONSULTANCY
Maturity and readiness
We benchmark your programme against the rules that apply to you and show exactly what closing the gaps takes.
Assessment against ISO/IEC 27036, NIST CSF 2.0 and NCSC CAF
Gap analysis for DORA, NIS2 and the UK critical third parties regime
Board-ready findings and a prioritised plan
MATURITY VS TARGET
ISO/IEC 27036
NCSC CAF
DORA
NIS2
Gaps ranked by effort and exposure
05 · CONSULTANCY
Programme design
A programme proportionate to your risk and your regulators, that suppliers can actually comply with.
Policy, tiering model and operating procedures
Security schedules and flow-down clauses by tier
Risk appetite, governance and a roadmap
TIERING MODEL
T1 · Critical
On-site audit
T2 · Important
Evidence review
T3 · Standard
Questionnaire
Proportionate to risk, not supplier count
06 · CONSULTANCY
M&A third-party due diligence
A target’s supply chain becomes yours on completion. We find what you’re inheriting before the deal closes.
Critical supplier, concentration and intelligence review
Obligations owed to the target’s customers
Red-flag report for deal teams, then an integration plan
RED-FLAG REPORT · TARGET
CONCENTRATION
62% of services on one host
INTELLIGENCE
Key supplier recently breached
OBLIGATIONS
9 flow-down clauses inherited
Price it in or fix it before close
03 / 03
Owned
by you.
The capability, built into your own estate and handed over. No platform licence.
WHO DOES THE WORK
SUPPLY ASSURE
YOUR TEAM
We build and hand over. You run it.
Ask about TPRM-in-a-box
07 · OWNED CAPABILITY
TPRM-in-a-box
Own the capability, not the licence. We build third-party risk management inside your own estate, on the enterprise AI platform you already run, then hand it over.
Runs in your own tenancy, so data never leaves your environment
AI-assisted workflows, with a human in the loop
No per-supplier licence as your supply chain grows
HANDOVER PATH
01
Discover
Your playbook and risk appetite
02
Build
Workflows in your tenancy
03
Train
Your team runs it with us
Handover
Yours to run
Who does what
Where we lead, where you lead, and where we work side by side.
ACTIVITY
Programme design and policy
Supplier inventory and tiering
Assessments and audits
Continuous monitoring and triage
Board and regulator reporting
Risk decisions and acceptance
Risk decisions always stay with you. We give you the intelligence to make them well.
Next step
Get in touch
