Third-Party Risk Management
Every vendor with access to your systems is part of your attack surface. Most teams manage that exposure with spreadsheets and annual questionnaires. Alvor brings structured assessment, continuous monitoring, and a complete audit trail to every vendor relationship - before something goes wrong.
Who it is for
One structured assessment, not a questionnaire you rebuild each time.
File the vendor before it exists, in a form built for you.
Answer in a portal, not a spreadsheet attached to an email.
Assessment workflow
Every vendor relationship follows the same structured path from onboarding request through to a formal, documented decision. No informal approvals. No gaps in the record.
A new vendor request or renewal is submitted with business context, data access scope, and the estimated go-live date. Alvor creates the vendor record and starts the SLA clock immediately - no vendor sits in a queue without an owner.
The product
01 · The portfolio
Who has been assessed, who is overdue, and where the residual risk sits across the portfolio. The reassessment cadence comes from the tier the intake produced, so nothing quietly ages out of review.
02 · A single vendor
Contacts, contracts, certifications, the scored assessment and the findings raised against it. Residual risk is accepted only by the person named to accept it, with conditions and an expiry, so acceptance is a decision rather than a status.
Portfolio visibility
A live portfolio dashboard that tells you exactly where your vendor risk is concentrated - without asking you to build it yourself in a pivot table.
Total Vendors
84
Critical Tier
6
Open Findings
23
SLA Breached
3
Low
Med
High
Crit
CRIT
HIGH
MED
LOW
Approval status
Domain scoring
Every assessment scores the vendor across eight security domains, weighted by their access type. The aggregate score drives the decision - with full transparency into which domain pulled it down.
Security Architecture
Network segmentation, encryption standards, and infrastructure hardening practices
Access Control
Identity management, MFA enforcement, and privileged access governance policies
Data Protection
Classification policies, at-rest and in-transit encryption, and retention controls
Incident Response
Detection capabilities, response playbooks, and breach notification timelines
Business Continuity
Recovery time objectives, tested disaster recovery plans, and geographic redundancy
Sub-Processor Risk
Visibility into subcontractors, nested vendor policies, and supply chain controls
Compliance
Active certifications (SOC 2, ISO 27001, PCI), audit histories, and regulatory standing
Physical Security
Facility access controls, data centre certifications, and physical access logging
What it replaces
The hard part of third-party risk is not the questionnaire. It is that the process stalls the moment it leaves your organisation.
Instead of
A questionnaire in a spreadsheet over email
Version confusion, no audit trail, and evidence attached to a thread.
In Alvor
A hardened external portal with a one-time code, autosave and evidence upload, writing every submission to the audit log.
Instead of
Onboarding with no security step
The vendor is live because the procurement form never asked the question.
In Alvor
Intake filed before the vendor exists, triaged and approved by someone other than the requester.
Instead of
A review that happens once
Assessed at signing, then never looked at again until something goes wrong.
In Alvor
A tier derived from the intake that sets the reassessment cadence, with findings carrying severity deadlines and a nightly breach sweep.
How it connects
Named precisely, because “everything connects to everything” is not a claim anyone can check.
Further reading
What a System Security Plan is, what goes in one, who requires it (NIST 800-171 and CMMC, FedRAMP, FISMA, Australia's ISM and IRAP), how to write one, and why most SSPs are out of date the day they are signed.
How research computing centres meet NIST SP 800-171 and CMMC obligations for controlled unclassified information on shared clusters: the enclave pattern, scoping, and the SP 800-223 zones it builds on.
Your first SOC 2 audit does not have to be a three-month panic. A structured, low-drama route to a Type II report: scoping, the control framework, a realistic timeline, evidence, exceptions, and what changes after the report.
Third-Party Risk Management
Alvor brings structure, consistency, and a complete audit trail to every third-party relationship - from the first request to the annual renewal. Your vendors, your risk, your record.