Supplier evaluation

Evaluate a supplier for feasibility before onboarding, and keep watching it afterwards.

Typical requirementsNIS2 Art. 21DORAISO 27001 A.5.19–5.22

Stage 1 of 5
Register
Record what the supplier will provide and which services and data depend on it.
Suppliers Assets
Links used
1. Suppliers provides Assets
2. Assets depends on Assets
WINGMAN and AI support
Fills the supplier record from the request and public sources.
Decides: The requester confirms.
Stage 2 of 5
Criticality and risk
Criticality follows from the assets it touches. Existing third-party risks are reused.
Suppliers Risks Assets
Links used
1. Risks involves Suppliers
2. Risks affects Assets
WINGMAN and AI support
Proposes criticality and matching risks.
Decides: The risk owner confirms.
Stage 3 of 5
Evaluation
Questionnaire, certifications, contract and data processing terms, exit plan.
Audits Suppliers Documents Evidence
Links used
1. Audits assesses Suppliers
2. Suppliers bound by Documents
3. Audits examines Evidence
WINGMAN and AI support
Reviews the answers against the evidence received and lists gaps.
Decides: Security and procurement review.
Stage 4 of 5
Decision
Approve, approve with conditions, or reject. Conditions become controls and tasks.
Roles Risks Controls Tasks
Links used
1. Roles owns Risks
2. Controls reduces Risks
3. Controls improved by Tasks
WINGMAN and AI support
Drafts the decision record and the conditions.
Decides: The accountable role decides.
Stage 5 of 5
Monitoring
Supplier signals and scheduled re-evaluations keep the record current.
Signals Suppliers Plans Assets
Links used
1. Signals concerns Suppliers
2. Plans reviews Assets
WINGMAN and AI support
Watches for supplier news and certificate expiry.
Decides: The supplier owner acts.

Sector angles

What this use case looks like under specific regulations.

NIS2

Supply-chain security as the law asks for it. Critical suppliers are evaluated before onboarding, and supplier notices reach the risk register.

Financial sector

Third-party risk under DORA and outsourcing guidelines, from pre-contract assessment to exit plans, feeding the register of information.

AI governance

Model and AI service providers are evaluated before use, and their changes reach the risk register.

CRA

Due diligence on third-party and open-source components before they enter the product.

GDPR

Processors are assessed before use, with data processing agreements and transfer safeguards kept on the supplier.

Videos

**WINGMAN AI GRC – financial sector (DORA, MiCA, ECB)** Live signals on critical functions, ICT and supply-chain risk, major incidents decided by people, and supervisor reports drafted for submission.

**WINGMAN AI GRC – supplier assessment automation** Automating supplier assessment with WINGMAN AI, from registering the supplier to the evaluation, the decision and ongoing monitoring.

Plays from youtube-nocookie.com. YouTube sets no cookies until you press play.

Other use cases

Incident handling

Support every stage of an incident, from the first signal to the risk review it should trigger.

Change management

Assess a planned change for impact, decide the controls needed before and after it, and keep one set of records as the result.

Regular reviews

Run the reviews good practice expects (assets, documents, risks, incidents, access) on a calendar instead of from memory.

Security operations control

Run security work through plans and tasks, with briefs, reminders and escalations, and ask "what needs to be done" against everything the model knows.

All use cases