Security questionnaires
Questionnaires aligned to ISO 27001, SOC 2 and the DPDP Act, sent, chased and reviewed for you.
Third-Party Risk Assessment
Check every vendor and partner before you trust them
Your vendors, suppliers and partners touch your customers, your systems and your data. One weak link can mean a breach, a regulatory finding or a failed delivery. We assess third parties before you onboard them, score the risk in plain language, and keep watching after you sign.
Vendor risk scorecardSample
64
Cloud payroll providerTier: High · Access to employee dataMedium risk
- Information securityStrong
- Data protection (DPDP)Gaps found
- Financial healthStable
- Legal & litigationClear
- Business continuityEvidence needed
The problem
Your risk now includes everyone you work with
- Vendors with access to your systems or data are a common route into a business.
- Regulators and large customers increasingly ask how you vet your suppliers.
- Spreadsheet questionnaires are slow, inconsistent and quickly out of date.
Our approach
Know exactly who you are dealing with before you share data, money or customers with a vendor or partner.
- 1Inventory
- 2Assess
- 3Score
- 4Monitor
What is included
What we do for you
Financial & legal checks
Company registration, directors, litigation history and financial health indicators.
Contract & compliance review
Data processing terms, SLAs, liability and exit clauses reviewed against your risk appetite.
Passive external review
A non-intrusive look at the vendor's public footprint: domains, email security and known breaches.
Risk scoring & tiering
Each third party is scored and tiered as critical, high or standard, so effort goes where risk is.
Ongoing monitoring
Scheduled re-assessment, plus alerts on material changes such as breaches or legal action.
How it works
Four clear steps
-
1
Inventory
List your vendors and partners, and what each one can access.
-
2
Assess
Questionnaires, document review, financial, legal and passive external checks.
-
3
Score
A plain-language risk score, tier and list of required fixes.
-
4
Monitor
Scheduled re-checks and alerts when something material changes.
What you get
- A third-party risk report with a clear score and tier
- An evidence pack you can show auditors, regulators and customers
- Remediation requests for the vendor, tracked to closure
- A vendor risk register that stays up to date
Who it is for
- NBFCs, fintechs and other firms subject to RBI, SEBI or IRDAI outsourcing and vendor-risk rules
- Enterprises onboarding IT, cloud and outsourcing vendors
- Any company that shares customer data with a partner
FAQ
Common questions
Anything else? We are happy to talk it through.
Do you test vendor systems without their permission?
No. Our external review uses only public, passive information. Any active security testing of a vendor happens only with written permission from that vendor.
How long does an assessment take?
It depends mostly on how quickly the vendor responds and how critical they are. We agree a target date when we scope the work and keep you updated until it is closed.
Are members of the Prime Assets network assessed too?
Yes. Every company is verified before it joins, and members can request a deeper assessment of any partner before working together.
Works well with
Related services
Ready when you are
Grow through partners you can trust.
Join the network, share a requirement, or ask for a risk assessment. A real person replies within one working day.