Audit coming up?
Supplier reviews not done before your audit?
Your auditor will ask how you assessed the suppliers that handle your data, and for the evidence. Start with a free scan of each one, send them the open questions in writing, and get a verified report for the suppliers that matter most.
Close the gap
Three steps, one supplier at a time.
Scan each supplier
A free, automated scan reads the supplier's public evidence, checks its certifications against official registries and returns a graded, source-linked result.
Ask in writing
Every scan ends with a ready-to-send email listing what the public evidence could not confirm. Forward it, and file the reply as evidence.
Verify what matters
For the suppliers your auditor will sample first, a verified report is checked by a person, reviewed before release and signed off. $390 for an existing report, $1,800 for a new one.
What auditors look for
Evidence that each supplier was assessed, not just listed.
A supplier register on its own rarely satisfies an auditor. They look for a dated assessment of each supplier, the basis for it, and what you did about the gaps.
Evidence a review should leave
- A dated assessment for each in-scope supplier
- Certifications checked against the issuing registry, not copied from a website
- Open questions put to the supplier in writing, with their replies
- A recorded decision and any conditions attached to it
- A trigger to reassess when the supplier or the service changes
Start with the suppliers your auditor will pick first.
The scan is free: the supplier's name and domain, and your email for the result. Reading any published report is always free.