Third-Party Risk Management
Every vendor with access to your systems is part of your attack surface. Most teams manage that exposure with spreadsheets and annual questionnaires. Alvor gives every vendor relationship a tier, a scored assessment, a reassessment date set by that tier and a complete audit trail.
Who it is for
One structured assessment, not a questionnaire you rebuild each time.
File the vendor before it exists, in a form built for you.
Answer in a portal, not a spreadsheet attached to an email.
Assessment workflow
Every vendor relationship follows the same structured path from onboarding request through to a formal, documented decision. No informal approvals. No gaps in the record.
A new vendor request or renewal is submitted with business context, data access scope, and the estimated go-live date. Alvor creates the vendor record and starts the SLA clock immediately - no vendor sits in a queue without an owner.
The product
01 · The portfolio
Who has been assessed, who is overdue, and where the residual risk sits across the portfolio. The reassessment cadence comes from the tier the intake produced, so nothing quietly ages out of review. Sub-processors are grouped across vendors, so one provider behind several Critical or High vendors shows up as a concentration.
02 · A single vendor
Contacts, contracts, certifications, the scored assessment and its findings. Each contract records its incident-notification window in hours and which protective clauses are present. Residual risk is accepted only by the person named to accept it, with conditions and an expiry. When the relationship ends, an offboarding checklist covers access, data return, the destruction certificate and the contract.
Portfolio visibility
A live portfolio dashboard that tells you exactly where your vendor risk is concentrated - without asking you to build it yourself in a pivot table.
Total Vendors
84
Critical Tier
6
Open Findings
23
SLA Breached
3
Low
Med
High
Crit
CRIT
HIGH
MED
LOW
Approval status
Domain scoring
Every assessment scores the vendor across eight security domains, weighted by their access type. The aggregate score drives the decision - with full transparency into which domain pulled it down.
Security Architecture
Network segmentation, encryption standards, and infrastructure hardening practices
Access Control
Identity management, MFA enforcement, and privileged access governance policies
Data Protection
Classification policies, at-rest and in-transit encryption, and retention controls
Incident Response
Detection capabilities, response playbooks, and breach notification timelines
Business Continuity
Recovery time objectives, tested disaster recovery plans, and geographic redundancy
Sub-Processor Risk
Visibility into subcontractors, nested vendor policies, and supply chain controls
Compliance
Active certifications (SOC 2, ISO 27001, PCI), audit histories, and regulatory standing
Physical Security
Facility access controls, data centre certifications, and physical access logging
What it replaces
The hard part of third-party risk is not the questionnaire. It is that the process stalls the moment it leaves your organisation.
Instead of
A questionnaire in a spreadsheet over email
Version confusion, no audit trail, and evidence attached to a thread.
In Alvor
A hardened external portal with a one-time code, autosave and evidence upload, writing every submission to the audit log.
Instead of
Onboarding with no security step
The vendor is live because the procurement form never asked the question.
In Alvor
Intake filed before the vendor exists, triaged and approved by someone other than the requester.
Instead of
A review that happens once
Assessed at signing, then never looked at again until something goes wrong.
In Alvor
A tier derived from the intake that sets the reassessment cadence, with findings carrying severity deadlines and a nightly breach sweep.
How it connects
Named precisely, because “everything connects to everything” is not a claim anyone can check. Select any module to see its links.
Links the product makes today
Third-Party Risk Management links to
Further reading
A data centre physical security audit checklist, each item mapped to the PSPF, ISM controls, CIRMP s 11, ISO 27001 A.7 and SOC 2 CC6.4, from site to rack.
What CIRMP section 11 requires of data centre physical security under the SOCI Act, and when the June 2026 enhanced rules can reach a data centre.
What a System Security Plan is, what goes in one, who requires it (NIST 800-171 and CMMC, FedRAMP, FISMA, Australia's ISM and IRAP), how to write one, and why most SSPs are out of date the day they are signed.
Third-Party Risk Management
Alvor brings structure, consistency, and a complete audit trail to every third-party relationship - from the first request to the annual renewal. Your vendors, your risk, your record.