Supplier check
Before signing, during a tender or after an incident. A one-off deep assessment of one supplier with a rated report and recommendations.
Target Five / Third-Party Risk Management
We assess your suppliers, their vulnerabilities and what the dark web knows about them. Continuously and auditably.
Supply-chain security as a turnkey service – no new tool, no extra work for your team.
Many serious incidents start at a supplier – IT outsourcing, an application provider or a cloud provider. NIS2 and the Czech Cybersecurity Act therefore explicitly require supply-chain security management. Our specialised service takes this obligation off your hands: we select suppliers with you, assess them in depth, monitor them continuously and keep records that stand up to inspection. We run it on the ImmuniWeb platform as an official partner – you don't need to learn any tool.
Assess your first supplierThe problem
01
You don't know how secure your suppliers are.
A questionnaire filled in once at contract signing says nothing about today.
02
An obligation without capacity.
Assessing dozens of suppliers, tracking changes and communicating with them is a full-time job.
03
No evidence.
An inspection requires proof of whom you assessed, when, with what result and what you did.
How it works
01
Scope proposal
We propose the list of critical suppliers and their domains. We only need your approval – no inputs from you.
02
Initial deep assessment
Each supplier undergoes a detailed analysis of its internet attack surface, vulnerabilities, data leaks and dark web mentions.
03
Continuous monitoring
Between assessments we track changes and new threats for every supplier.
04
Mid-year deep assessment
A second assessment halfway through the year shows the trend.
05
Monthly analysis & handover
A Target Five analyst consolidates findings, writes the report, hands it to your contact (email, Teams, shared register) and helps with supplier communication.
06
Annual review
A full-year summary, contractual and technical recommendations and an updated supplier list.
What you get
- A security profile of every monitored supplier and its trend over time
- A supplier assessment register as audit and inspection evidence
- A monthly report with prioritised findings and recommended actions
- Recommendations for contract requirements, tenders and exit strategies
- An analyst who runs the service for you
Packages & engagement options
TPRM Start
Smaller regulated entities. Up to 10 suppliers, 2 deep assessments per year, continuous monitoring, quarterly report, assessment register.
TPRM Standard
Mid-size and large organisations, public sector. Up to 25 suppliers, 2 deep assessments per year, continuous monitoring, monthly report, register, finding escalation, annual review.
TPRM Enterprise
Groups, critical infrastructure. 50+ suppliers, custom frequency, integration with Black Radar, ITSM or GRC, support for supplier communication.
+ CTEM
Add-on to any package. Monitoring of your own attack surface on the same platform and in the same monthly report.
Additional suppliers can be added one at a time. Price on request.
Who it's for
- Regulated entities under the Czech Cybersecurity Act
- Public sector
- Financial sector (DORA)
- Organisations with extensive IT outsourcing
- Procurement and supplier management
Compliance
- NIS2 / Czech Cybersecurity Act: supply-chain security, risk management
- ISO 27001:2022: A.5.19–A.5.22 (supplier relationships, monitoring and review of supplier services)
- DORA: ICT third-party risk management
FAQ
01
Will the supplier know we're assessing them?
Assessments run passively from public and intelligence sources, with no access to their systems.
02
Do we need to provide a list of suppliers and domains?
No. We prepare the proposal ourselves and you just approve it.
03
What if you find a serious problem at a supplier?
We escalate it immediately to your designated contact and prepare material for communicating with the supplier.
04
Does this replace security questionnaires?
It complements them with an objective, continuously updated outside view. We can build questionnaires into the process.