Supplier & Vendor Portal forstructured TPRM
Suppliers fill out questionnaires on their own and upload proof. Core then scores the risk for you. No more email ping-pong.
What you get
- Self-service questionnaires
- Upload of proof
- Risk scoring
- SIG / CAIQ templates
- Vendor dashboard
- NDA workflow
Features at a glance
Manage third-party risk in a clear, set way. Use proven templates and let the tool do the routine work.
Questionnaire Templates
Ready-made templates such as SIG Lite, SIG Core, CAIQ and TISAX. Use them as they are, adapt them or build your own questionnaires in the editor.
Self-service Portal
Each supplier gets a personal link by email. No account is needed. They fill out the questionnaire at their own pace. The portal shows your brand.
Evidence Upload
Suppliers upload their certificates, audit reports and policies in a safe way. Each file is linked to the answer it backs up.
Automatic Scoring
Core weights the answers and builds a risk score. A traffic light shows low, medium or high. You also see the trend, a comparison with similar firms and critical gaps.
Re-assessment Cycles
The review interval depends on the level: 12 months for Intensive, 36 months for Standard. Basic suppliers are checked when there is a reason. Reminders go out by themselves.
Dashboards & Alerts
Dashboards show your managers vendor risk at a glance. They also show overdue reviews and serious findings. You get an alert when a score gets worse.
Your benefits
The law now makes firms track how secure each supplier is. A vendor portal ends the back-and-forth by email. In its place you get one clear process. You can repeat it, and auditors can check it.
- Works for 10 to more than 1,000 suppliers
- Less work, since suppliers fill out the forms themselves
- The same clear risk score for each supplier
- Proof stays in one place, with each version kept
- Helps with NIS2, DORA and GDPR rules for the supply chain
Use cases
Onboarding new suppliers
Before you work with a new vendor, it goes through a fixed security check. Questionnaire and NDA run online.
NIS2 supply chain
NIS2 requires you to assess your key suppliers. The portal helps you do that.
Regular vendor review
Follow-up assessments use the same checklist. The interval depends on the level. So your view of supplier risk stays up to date.
Tender pre-screening
Possible suppliers fill out a questionnaire during the tender. So you see early who fits.
How the Supplier Portal works in practice
SecTepe.Core takes each supplier through fixed steps. A new supplier starts as a draft. Then come pre-assessment and assessment, and finally approval or rejection. Core logs every status change with the person, the time and the reason.
The initial assessment
Three yes-or-no questions set how deep the check goes. Does the supplier get access to your systems or network? Does it process your confidential data? Does a core process stop if the supplier fails?
- No yes: the Basic level with 4 questions.
- One yes: the Standard level with 9 questions.
- Two yes answers, or a yes to the third question: the Intensive level with 12 questions.
Each question refers to controls from ISO 27001 Annex A. A valid ISO 27001 certificate held by the supplier answers some questions for you. Core checks the number, the accredited body, the scope and the expiry date. You can only approve a supplier once this assessment is complete.
Questionnaires and documents
You send the questionnaire as a personal link by email. The supplier does not need an account. By default, the link expires after 30 days. Core weights the answers and builds a score. From 80 points the risk is low, from 60 it is medium. Below that it is high.
For each supplier you list the documents you need, such as certificates. Each document has a validity date. Once that date has passed, Core marks the document as expired. You can also filter for documents that expire soon.
Reviews, threats and data sovereignty
- The level sets the next review. Intensive suppliers are due after 12 months, Standard suppliers after 36 months. Basic suppliers are only checked again when there is a reason.
- Core can match suppliers against threat data from its knowledge graph on cyber threats. Hits become alerts that you confirm or close.
- You can host Core yourself, in containers on your own servers or on Kubernetes. Each supplier belongs to exactly one tenant.
Common questions
Can I approve a supplier without an assessment? No. Core blocks the approval until the initial assessment is done.
What happens to old findings? You can run as many follow-up assessments as you need. They use the same checklist. When you finish one, Core closes the open findings of the one before. Each finding is then marked as carried over, fixed or no longer checked.
Can a rejected supplier start again? Yes. It can go back to draft and run through the steps once more.
Ready to bring order to third-party risk?
Book a personal demo. See how SecTepe.Core makes vendor checks simple, from the first onboarding to each new review.
How we work with you
We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.
1. Free initial conversation
We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.
2. Current state review
We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.
3. Delivery with a dedicated lead
An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.
4. Running and reviewing
After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.
Common questions
We hear these questions most often in a first call. For anything else, write to hello@sectepe.de or give us a call.
- How do we start working with SecTepe?
- Every project starts with a free first call. Then you get an offer with scope, timeline and result. If you like, we start small with a pilot. That way you get to know us before the real work starts.
- What company sizes and sectors do you support?
- We work for small and mid-sized firms, for parts of large groups and for operators of critical infrastructure (KRITIS). Often that means industry, trades, health, banks, energy and public bodies. Our focus is mid-sized firms in Germany, Austria and Switzerland.
- Do you work on site, remotely or hybrid?
- Both. Reviews, advice and most services run remotely from German data centers. For workshops, training and emergencies we come to you, mainly in North Rhine-Westphalia, the Rhineland and the Ruhr area. We travel further when needed.
- Which standards and regulations do you cover?
- We work to ISO 27001:2022, BSI IT-Grundschutz, TISAX, B3S KRITIS, NIS2 and DORA, plus sector-specific rules. Our methods build on known frameworks such as NIST CSF, MITRE ATT&CK, OWASP and OSSTMM. We combine them to fit each project.
- How do you protect the confidentiality of my data?
- By contract and by technology. Before every project, both sides sign a non-disclosure agreement. Your data stays in German data centers. Every access needs a second login factor and is checked one by one. Our whole team is bound to secrecy by contract and under the GDPR.