Scrutineer · Vendor risk

Supplier risk management software for supply chain risk management

Supplier risk rarely announces itself. A supplier loses a key certification, gets breached, or quietly degrades its security posture, and the first you hear of it is a disrupted shipment, a compromised integration or an auditor's finding. Supplier risk management software exists to close that blind spot. Scrutineer assesses each supplier against a consistent standard, turns the assessment into an evidence-backed risk score, and keeps monitoring after the contract is signed.

Procurement, security and compliance finally work from the same picture: which suppliers touch sensitive data or critical operations, which carry expired certifications or weak controls, and which need reassessment now rather than at renewal. Scores refresh as conditions change, so a deteriorating supplier surfaces early instead of after the incident. Your team keeps every sourcing and offboarding decision; Scrutineer supplies the structured evidence to make those calls defensible.

or try it below ↓

Control-mapped findings · linked evidence · you decide what to remediate

The Scrutiny Desk

Interactive walkthrough on a sample company, not a scan of your systems.

Worked example with sample findings, not a scrutiny of your environment. Not an audit attestation.

SOC 2 ISO 27001 HIPAA GDPR PCI DSS

Controls in evidence-linked report out

AI scrutinizes you decide

Why it works

What you get with supplier risk

The SBOM baseline moved in July 2026, and it now covers SaaS

If your supplier questionnaire asks for a software bill of materials, the answer you get back is measured against a document that changed a month ago. On July 29, 2026 CISA, the NSA, the FBI and a long list of international partners published the 2026 Minimum Elements for a Software Bill of Materials, which updates and replaces the minimum elements NTIA published on July 12, 2021. Ten data fields are new, including component hash value and hash algorithm, component license, SBOM generation context, SBOM tool name and version, and an SBOM author signature. The scope line is the part most procurement teams have not absorbed: the minimum elements apply to SBOMs for all software, including open source, AI software and software as a service. Two consequences follow. Component license is now baseline, so the artifact you asked for on security grounds arrives carrying legal exposure that nobody in legal has read. And an SBOM is now expected to be signed and attributable, which turns it from a text file somebody generated into an assertion somebody made.

Cyber supply chain risk is a separate discipline from supplier onboarding

Assessing a supplier and managing cyber supply chain risk look similar on a slide and behave nothing alike in practice. The reference text in the US is NIST Special Publication 800-161r1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations. Note the version: the May 2022 edition was withdrawn on November 1, 2024 and superseded by 800-161r1-upd1, so a program built on a downloaded copy from 2022 or 2023 is citing an archived document. The publication organizes the work across three levels, enterprise, mission and business process, and operational, and the point of that structure is that the same supplier decision needs a different answer at each one. Procurement is usually operating only at level three, one supplier at a time, which is why concentration and systemic exposure never surface. NIST pairs it with the NISTIR 8286 series on integrating cybersecurity risk into enterprise risk management, which is the bridge most supplier programs never build.

Tiering is the only thing that makes continuous oversight affordable

Every supplier program eventually collides with the same arithmetic. Real diligence costs several hours per supplier per cycle, and nobody has that many hours for four hundred suppliers. The answer is not a cheaper questionnaire, it is a defensible tier definition that ties depth of review to what the supplier can actually reach: the data it holds, the systems it touches, whether it sits in a critical path with no alternate, and whether its failure would be visible to your customers. Criticality is your organization judgment to make, not a rating any external tool can assign for you, and examiners expect to see the reasoning rather than a number. Once tiers are honest, the top tier gets contract review, exit terms and monitored events, the middle tier gets an annual evidence refresh, and the tail gets an intake record and nothing more. That is a program you can actually run.

What it handles

Controls in, an evidence-linked report out

Point Scrutineer at a framework or a vendor and it maps every control, pulls the evidence it can find, flags the gaps and scores the risk, returning a report with linked evidence and a prioritized remediation list. Scrutineer is decision support for readiness, an accredited auditor still issues the attestation.

Assesses every supplier against one consistent standard, so two reviewers reach the same tier from the same facts
Scores each supplier on evidence you can open, not on a rating somebody else calculated from outside signals
Tiers suppliers by data reach, system access and operational criticality, and records the reasoning behind the tier
Tracks certification expiry dates rather than filing a SOC 2 report once at onboarding and never opening it again
Keeps SBOMs and component inventories against the supplier record, so an advisory becomes a lookup instead of a survey
Watches ownership changes, incidents and lapses as monitored events, because almost nothing that changes supplier risk lands on your review date
Holds the exit terms that decide your options during an insolvency: data return format, transition assistance and escrow
Feeds the same control library your SOC 2, ISO 27001 and vendor risk work runs on, so supplier oversight is not a separate program

Supplier risk readiness_report

Readiness 82%

ACCESS CONTROL 91

evidence · MFA enforced and access reviews evidenced.

CHANGE MGMT 78

evidence · Mostly covered; one approval log left untested.

VENDOR RISK 64

evidence · Two subprocessors missing a current review.

ENCRYPTION 86

evidence · Data encrypted in transit and at rest, evidenced.

Every finding links to the evidence behind it

Why Scrutineer

One platform that maps controls and scores risk

Not a static questionnaire, not a pass-fail black box, and not a spreadsheet you maintain by hand. Live control mapping across SOC 2, ISO 27001, HIPAA, GDPR and PCI, automatic evidence and a prioritized gap list, returned as a report you can act on. The AI scrutinizes, you decide.

Mapped to real controls

Every framework is broken down into the controls it actually requires, each scored on a red to amber to green scale, so readiness stays transparent and consistent.

Evidence behind every finding

Each control links to the exact evidence that satisfies it, the policy, the config, the log line, so the finding is auditable and your readiness is defensible.

A prioritized gap list

Open gaps roll up into a ranked remediation list, so the highest-risk findings sit at the top and your team fixes what matters before the audit begins.

Supplier failure reference

What actually breaks, how fast it reaches your customer, and whether you can substitute

Published supplier risk tables almost always score suppliers: tier, criticality, questionnaire result, a color. A score tells you where to look. It does not tell you what happens next. This table runs on the failure and the clock, because during an incident there are only two questions, how long you have and whether anyone else can do the job.

What fails at the supplier	How long before your customer feels it	Substitution	What actually shortens the outage	The artifact that proves you planned for it
A sole-source supplier with no drop-in equivalent stops delivering	Immediately for anything in the critical path. There is no grace period and no workaround to buy time with	None in the short term. Requalifying an alternate is a project, not a decision	Having already qualified a second source, or holding enough buffer to survive the requalification	A named alternate on the supplier record with the date it was last qualified
A cloud region or hosting provider your supplier sits on goes down	Minutes to hours, and usually at the same moment as every other customer of that provider	Only if the supplier is genuinely multi-region and has tested a failover recently	Your supplier architecture, which you can only influence before you sign	The resilience commitments in the contract and the last failover test result they shared
The supplier is breached and your data is in scope	Days, once notification clocks start running, and immediately in front of any customer who reads the news	Irrelevant. Changing supplier afterwards does not un-disclose the data	Having limited what the supplier could reach before any of this happened	The data inventory for that supplier plus the notification clause and its deadline
A certification lapses: the SOC 2 period ends or the ISO certificate expires	Nothing breaks operationally. It surfaces in your next audit or in a customer review	Not applicable. This is a documentation gap, not an outage	Tracking expiry dates as dates, rather than collecting a report once at onboarding	The current report or certificate on file, with its period, its scope and its expiry
The supplier is acquired and the product goes on a sunset path	Twelve to thirty-six months of quiet degradation, then a hard end-of-life date	Yes, if you start when the acquisition is announced rather than when the notice arrives	Treating ownership change as a monitored event instead of news somebody happens to read	A dated record of the ownership change and the migration decision that followed it
The supplier becomes insolvent	Weeks, usually with no signal anyone outside their finance team would have seen	Depends entirely on whether you hold your own data and can actually get it out	Exit terms agreed before signature: data return format, transition assistance, source escrow	The termination and data return clauses, and the date of your last successful export
Nothing fails at the supplier at all. A component inside the software they ship has a critical vulnerability	Whenever an attacker reaches it first. Your continuity plan never fires, because nothing went down	Substitution does not apply. You cannot swap out a component you did not know was there	Holding the component inventory before the advisory lands, so the question becomes which products rather than whether	A current SBOM naming the component, its version, its producer and its hash, which the July 2026 minimum elements now expect for SaaS as well as installed software

SBOM expectations follow the 2026 Minimum Elements for a Software Bill of Materials published by CISA with the NSA, the FBI and international partners on July 29, 2026, which updates and replaces the NTIA minimum elements of July 12, 2021. Cyber supply chain practice follows NIST SP 800-161r1-upd1 of November 1, 2024. Timelines here are the shape of each failure rather than a promise about your suppliers, and your own contracts govern what you can compel. Scrutineer organizes readiness evidence and does not issue attestations or certifications.

Good questions

Questions about supplier risk

Cyber supply chain risk management, usually shortened to C-SCRM, is the practice of managing the cybersecurity risk that arrives through the products, components and services you buy. The US reference is NIST SP 800-161r1-upd1, which organizes the work across three levels: enterprise, mission and business process, and operational. Supplier assessment sits at the operational level only.

Supplier risk management looks at one counterparty at a time: who they are, what they can reach, whether they are healthy. Supply chain risk management looks at the network those suppliers form, where dependencies concentrate, and what happens when one node fails. Most programs do the first well and never do the second, which is where systemic exposure hides.

Yes for anything running in your environment or handling regulated data, and now for software as a service too. The 2026 Minimum Elements for a Software Bill of Materials state that the baseline applies to all software including open source, AI software and SaaS. Ask in the contract rather than the questionnaire, because a questionnaire answer expires and a contractual obligation does not.

CISA and partners published the 2026 Minimum Elements on July 29, 2026, replacing the NTIA version from July 12, 2021. Ten fields are new, including component hash value and algorithm, component license, SBOM generation context, SBOM tool name and version, and an SBOM author signature. The Access Controls element was removed and folded into distribution and delivery.

Tier on what the supplier can reach and what its failure would cost, not on contract value. The practical inputs are the data it holds, the systems it can access, whether it sits in a critical path with no qualified alternate, and whether a failure would be visible to your customers. Criticality is your organization judgment to make, and the reasoning matters more than the score.

Annual reassessment is the convention and it catches very little, because almost nothing that changes a supplier risk profile happens on your review date. Set the top tier on a real cycle, then drive everything else from events: a breach, a lapsed certification, an ownership change, a new subcontractor, a material change in what the supplier can reach.

Four things, all agreed before signature: the format and timing of data return, how long transition assistance lasts and who pays for it, whether source escrow applies, and the termination rights you hold if the supplier breaches. During an insolvency these clauses are the only leverage anyone has, and there is no time left to negotiate them.

Usually not a second system. If you already tier, assess and monitor third parties, the gap is normally coverage rather than tooling: physical suppliers, sole-source dependencies and component-level software risk sitting outside the security review. Extend the program you have before buying a parallel one that will disagree with it within two quarters.

Supplier risk management software identifies, assesses, scores and continuously monitors the risks your suppliers carry: cybersecurity, compliance, operational and reputational. It replaces one-off questionnaires and spreadsheets with a live, scored view of the whole supplier portfolio, so problems surface before they disrupt your business.

In practice the terms overlap heavily. Supplier risk management grew out of procurement and supply chain teams and often emphasizes operational continuity, while vendor risk management grew out of IT and security and emphasizes data access. Scrutineer treats both as the same discipline: assess, score and monitor every third party on a consistent standard.

Start with a structured intake covering what the supplier does, the data and systems it can reach, and its certifications. Score the responses against a consistent standard, weight by criticality, and tier the supplier accordingly. Then keep monitoring: certifications lapse and postures change, so a one-time assessment goes stale fast.

Because modern supply chains concentrate risk in companies you do not control. A single supplier breach, certification lapse or operational failure can cascade into your own compliance posture, customer commitments and revenue. Software makes oversight continuous and consistent, which spreadsheets and annual questionnaires cannot.

Read every compliance and risk question

Keep reading

Guides that go deeper on supplier and supply chain risk

Vendor tiering that holds up in an audit

How to set tier definitions so diligence depth matches exposure instead of contract value.

Read the guide

Best fourth-party risk management software

The subcontractors behind your suppliers, what each category of tool can see, and what it cannot.

Read the guide

Best third-party risk management software

How the third-party risk platforms compare on assessment, monitoring and evidence.

Read the guide

Explore more

More ways to scrutinize compliance and risk with Scrutineer

SOC 2 compliance

Map controls to the Trust Services Criteria, collect evidence, and close gaps before audit.

Learn more

SOC 2 compliance software

A platform that maps SOC 2 controls, automates evidence, and tracks readiness continuously.

Learn more

ISO 27001 compliance

Map your ISMS to Annex A, automate evidence, and stay certification-ready.

Learn more

See every use case See pricing Back to Scrutineer

Stop guessing about readiness. Scrutinize on real evidence.

Point Scrutineer at a framework or a vendor and it maps every control, gathers evidence and scores the risk, returning an evidence-linked report and a prioritized gap list. The AI scrutinizes, you decide.

See pricing

SOC 2, ISO 27001, HIPAA, GDPR & PCI · evidence-linked controls · readiness, not certification