Third parties · Third-party risk management
Know which supplier has access to what, and what each one owes you
It usually lives in emails and in a spreadsheet nobody updates. Almenara tracks each supplier from onboarding to the warning that something is about to expire, and your supplier answers from its portal at no cost.
A supplier’s life, from onboarding to the warning
Your payroll provider, from start to finish. At each step, what you see and what it sees in its portal.
Sample data
Month 1
Onboarding
You add it with its service and the data it accesses. It processes the payroll of your whole workforce, with personal and bank data: it is rated high criticality.
- What you see
- Its criticality, worked out from your answers, and a yearly reassessment.
- What your supplier sees
- Nothing yet: it needs no account until the questionnaire arrives.
Month 1
Questionnaire
It receives a five-question questionnaire, chosen by its criticality, with 30 days to answer.
- What you see
- The status of each question, without chasing emails.
- What your supplier sees
- What is asked, why and by when, in its free portal.
Month 2
Blocking finding
It does not encrypt the data it stores. Approval is blocked until it is fixed.
- What you see
- The finding, linked to the question and the evidence that shows it.
- AI proposes
The encryption policy covers data in transit but says nothing about stored data.A person decides
The assessor confirms it and marks it as a finding that blocks approval. - What your supplier sees
- Only that question comes back, with a note on what is missing. The rest stays as it was.
Month 2
Action plan
Your supplier commits to encrypting stored data by a date, with someone responsible.
- What you see
- The action and its date, with a warning if the date approaches and it is still open.
- What your supplier sees
- Its commitment and the date, visible in the portal.
Month 3
Approved with conditions
You approve it as long as the plan stays on schedule. Who approved it, when and on what conditions is recorded.
- What you see
- The approval and its conditions, in the change log.
- What your supplier sees
- That it is approved and what it still has to do.
Month 14
Its certificate expires
Eleven months after you approved it, its ISO 27001 certificate expires in 30 days. You both get the warning before it does.
- What you see
- The reassessment already proposed, with what was validated.
- What your supplier sees
- To upload the renewed certificate. If it already validated it in the directory for another customer, it does not upload it again.
The same questionnaire, from both sides
This is the questionnaire from step 2 after the first review. You see the status of each question and what the AI proposes; a person decides. Your supplier sees it in its portal, which is free: what is asked, why and by when.
Sample data
ISMS.01
ValidatedDo you have a certified information security management system?
Evidence: iso27001-certificate.pdf
AI proposal · Accept: current certificate, with a scope that covers the payroll service.
ENC.03
ReturnedDo you encrypt data at rest and in transit?
Evidence: encryption-policy-v3.pdf
AI proposal · Return: the policy covers data in transit but not stored data.
SUB.02
ValidatedWhich subcontractors process our data?
Evidence: subprocessor-register.xlsx
AI proposal · Accept: declares two, with their service and country.
BCP.04
Under reviewHave you tested your continuity plan in the last twelve months?
Evidence: continuity-test-2026.pdf
AI proposal · Review: the test recovers the payroll calculation, not the payment run.
INC.01
No answerWill you notify us within 24 hours of an incident affecting our data?
No answer yet
Sample data
- Your organisation: select for the summary
- Subcontracts
- Evidence returned
On narrow screens you see the critical and high-criticality suppliers. The table lists them all.
40 suppliers · all
Your whole supply chain, and the supplier that needs attention
The closer to the centre, the more critical the supplier. The lines join each one to the subcontractors it declares: your suppliers’ suppliers. The amber dot is the only one with a returned piece of evidence.
6 suppliers depend on the same cloud provider
If that provider goes down, six go down at once, even if none of them has anything outstanding. Each one’s profile says how many it shares the dependency with.
The six
- Velmora Pagos
- Fendril Identidad
- Quintela ERP
- Tarsia Copias
- Marcial CRM
- Nubeda Formación
Sample data
See it before you talk to anyone
Demo
Your cloud provider goes down
Your cloud provider’s notice reaches its record and, from there, everything that depends on it. The whole case, told from the screen.
Walk through the case
What the platform does and what our team does
With the module, your team does the work and the platform organises it, reminds you and keeps it with its evidence. If you’d rather delegate part of it, our team does it as a fixed-scope service, contracted separately.
What the platform does
- Keeps the supplier inventory with each supplier’s criticality, including ICT providers supporting critical or important functions
- Sends questionnaires and collects answers in the supplier’s portal, at no cost to them
- Records the review of each piece of evidence and returns what falls short with what is missing
- Alerts you before a reassessment is due, according to each supplier’s criticality
- Keeps the DORA register of information up to date with the data you already manage
- Reuses the certificates the supplier has already validated in the directory, at no cost
What our team does
Initial supplier reviewWhen you start
We review up to 50 suppliers and classify them by criticality, so you start with the inventory done.
DORA register of informationEvery year
We prepare the register of information on your arrangements with ICT providers, leave it ready for you to submit to your supervisor and update it every year.
Supplier exit planPer supplier
We design how to leave a critical supplier without stopping the processes that depend on it.
Supplier auditWhen needed
We audit a critical supplier in depth when the assessment is not enough.
Shared supplier assessmentEvery year
For suppliers: we assess you once a year and you share the full assessment with the customers you choose, among those using Almenara.
What Third parties connects with
What happens in this module reaches the others without being entered again.
- ComplianceEach supplier’s risk feeds the risk assessment and the Statement of Applicability (controls 5.19–5.22) without being copied by hand.See the 2 connections
- ContinuityCritical suppliers enter the BIA as dependencies, and their exit plans are part of the continuity plan.See the 4 connections
- IncidentsAn incident at a supplier is linked to its record and triggers a review of its criticality and next assessment.See the 4 connections
And the same assessment of each supplier works for ISO 27001, Spain’s National Security Framework (ENS), DORA, NIS2 or a customer’s questionnaire.
See it with your own data
Ask for information or a meeting: in 60 minutes we load a sample of your data and you see it working.