Every vendor, and what they owe you.
Keep a complete inventory of third parties with owners, services, sub-processors and contract terms. A tier wizard sets assessment depth, an explainable score tracks risk, and AI extracts the cybersecurity obligations from each contract.
| Vendor | Service | Tier | Risk |
|---|---|---|---|
| Northwind Payroll | HR SaaS | Critical | High |
| Contoso Cloud | IaaS hosting | Critical | Medium |
| Fabrikam Labs | Clinical data | High | Medium |
| Tailspin Print | Print services | Low | Low |
| Adatum Analytics | BI platform | High | Low |
Illustration with sample data
What Third-Party Register does
The Third-Party Register is the governed inventory of vendors, suppliers and other third parties. Each profile holds business details, Business, TPRM and Risk owners, an operational profile and the risk-relevant contract terms: dates, notice, breach-notification hours, and audit, security and data-return clauses. Upload a contract and AI extracts the cybersecurity obligations the vendor is bound to.
The risk tier wizard asks about service location, activity type, data elements and volume, and sets the tier to Low, Medium, High or Critical using a formula you can configure. Overrides need a reason and persist, and a tier increase triggers re-approval and reassessment. A deterministic 0–100 score is built from named drivers, so every point is explained, and AI never sets it. Dashboard, My Actions, Data Quality and Approved Third Parties tabs keep the programme on track.
Key capabilities
Rich vendor profile
Owners, services, sub-processors, operational profile and contract terms.
AI obligation extraction
Cybersecurity obligations pulled from uploaded contracts.
Configurable tiering
A tier wizard with your formula; reasoned overrides that persist.
Explainable score
A 0–100 score from named drivers, with a daily history.
Data quality
Lists what is missing and never fills values in.
Approved vendors
A reference list of vendors whose due diligence was approved.
The business case.
Efficiency, multi-framework alignment, reduced complexity and streamlined processes: what Third-Party Register changes for your programme.
Less contract and profile work
AI extraction and structured profiles replace manual contract reading.
Supplier register
A structured vendor inventory supports supply-chain requirements.
Know what to hold vendors to
Contractual duties are visible during assessments and incidents.
For procurement, security and legal
Everyone works from the same vendor record.
Efficiency figures compare the effort of each workflow cycle in RiskVantis with the same work done manually or in a traditional GRC tool. Your result depends on your starting point; we will model it with you in a demo.
From setup to outcome.
Add the vendor
Capture the profile, owners and services.
Tier it
Run the tier wizard to set assessment depth.
Extract obligations
Upload the contract; AI lists the obligations.
Govern
Move the vendor through due diligence, assessment and approval.
Supports your obligations.
Third-Party Register contributes evidence and coverage to these frameworks and regulations.
Common questions.
Can AI change a vendor's tier or score?
No. The tier comes from the wizard or a reasoned override, and the score from named drivers. AI never sets either.
What contract terms are tracked?
Dates, notice periods, breach-notification hours, and audit, security and data-return clauses. These drive alerts, but this is not contract management.
Can I upload the contract later?
Yes. Add it when creating the third party or later from the profile.
Works better together.
Third-Party Lifecycle & Approvals
Every vendor moves through a governed lifecycle. Onboarding is blocked until the checklist passes, risk decisions are approved at the right level for the tier, and…
Learn more →Third-Party Risk ManagementThird-Party Assessments
Send secure, no-login assessments that vendors can save and share question by question. Review each answer with AI assistance, and run reassessments that reuse earlier…
Learn more →Third-Party Risk ManagementSub-processors & Assessment Cascade
Map each vendor's services and sub-processors at every level, see the group's real risk, and extend an assessment to the fourth parties that matter, without duplicates…
Learn more →See Third-Party Register in action.
Book a 30-minute walkthrough tailored to your frameworks, vendors and team.