Third-Party Risk Register
Every supplier, scored and tracked. Inherent and residual risk on a documented likelihood × impact matrix, the controls each vendor evidences, DORA critical-or-important criticality, review-cadence overdue flags and concentration-risk detection — all in your browser.
Review cadence by criticality
When a vendor has no explicit next-review date, the due date is derived from its last assessment plus the cadence for its tier. Reviews past due are flagged overdue.
Add vendor
Import
Paste a CSV (a header row with at least a name / vendor column; other columns are matched by name: service, provider, hosting, data classification, likelihood, impact, controls, tier, contract, dates, owner, status, notes) or a JSON export from this tool. Rows are added; a vendor with the same name is updated, and blank cells never erase existing values. Computed columns (scores, bands) are ignored on import and re-derived.
| Controls | Risk owner |
|---|
No vendors yet. Add one, or import your existing list as CSV.
The risk scale & matrix
Likelihood
Impact
Likelihood × Impact
Inherent risk = likelihood × impact (1–25). Controls reduce the likelihood by their effectiveness (none 0, partial 1, substantial 2, strong 3 steps, never below 1); impact is left unchanged, because preventive controls do not shrink the loss if it still lands. Bands: 1–4 low, 5–9 medium, 10–14 high, 15–25 critical. Scale after ISO 31000 / ISO 27005.
Criticality follows the DORA logic for critical or important functions (Reg. (EU) 2022/2554, Art. 3(22)): a vendor whose failure would materially impair operations is critical on that alone; two or more of the four criteria make it critical, one makes it important. The controls / assurance fields map to the ISO/IEC 27001:2022 Annex A supplier-relationship controls (A.5.19–A.5.22); concentration flags follow DORA Art. 28(4)(c). This is the operational register; for the regulatory Register of Information (DORA Art. 28(3), ITS templates) use the DORA Register of Information builder, and to go deeper on one vendor open the Vendor Risk Questionnaire. A register / aid only — not legal advice, and it does not make you compliant.