Modern third-party risk management for ICT providers.
Replace scattered spreadsheets and mailboxes with a connected lifecycle: inventory, criticality, assessments, evidence, risks, remediation and continuous review.
ICT Providers
96 providers · 18 critical
| Provider | ICT Service | Criticality | Country | Risk |
|---|---|---|---|---|
| Halcyon Cloud Services | Cloud Infrastructure | Critical | Ireland | High |
| Northwind Cloud Ireland | Cloud & Productivity | Critical | Ireland | Medium |
| Payflux Payments Europe | Payment Processing | Critical | Ireland | High |
| Lumendata Netherlands | Data Platform | Important | Netherlands | Medium |
| Edgeway Germany | Network & Security | Important | Germany | Low |
| Valtera | Core Banking | Critical | Switzerland | Medium |
Lifecycle
Seven stages, one record.
Inventory
Every ICT provider and the services they deliver.
Criticality
Critical, important or standard, and whether a critical function depends on it.
Assessments
Structured questionnaires with a vendor portal.
Evidence
Certifications and reports with expiry tracking.
Risks
Findings become owned, scored risks.
Remediation
Mitigation plans with due dates and progress.
Continuous review
Reassessment cycles triggered by criticality and change.
Reporting
Board and audit reporting from the same data.
Assessments
Assessments that produce decisions, not PDFs.
- Section-level progress across every vendor
- Evidence requested inside the questionnaire
- Reviewer decisions recorded per response
- Findings convert to risks in one click
ASM-2041 · Halcyon Annual ICT Assessment
Under Review117 questions · 12 sections · vendor submitted 4 August 2026
Section progress
- Governance & Oversight100%
- Information Security92%
- Business Continuity64%
- Incident Management88%
- Subcontracting45%
Q 4.3 · Business Continuity
Describe the frequency and scope of your disaster recovery testing.
“DR testing is performed periodically across production regions.”
AI Finding
78% confidenceDisaster recovery testing evidence is missing.
The response describes testing but no test report was attached for the current period. Requires human review before any compliance decision.
Reviewed by Sarah Martin · AI suggestions never change compliance status automatically.
Evidence
Documentation that never silently expires.
- Valid, Expiring, Expired and Missing statuses
- Automated requests to vendor contacts
- Coverage by provider and criticality
- Documents linked to the risks they support
Evidence Library
418 documents · 23 missing · 11 expiring within 60 days
- Expires 30 Nov 2026Valid
SOC 2 Type II
Halcyon Cloud Services
- Expires 21 Mar 2027Valid
ISO 27001
Northwind Cloud Ireland
- Expires 14 Sep 2026Expiring
Penetration Test
Payflux Payments Europe
- Expired 2 Jun 2026Expired
Business Continuity Plan
Lumendata Netherlands
- Requested 4 Aug 2026Missing
Disaster Recovery Test
Halcyon Cloud Services
Remediation
One register for outstanding third-party risk.
- Severity scoring against your risk appetite
- Named owner and due date on every risk
- Acceptance with documented rationale
- Full history for audit
Risk Register
7 high risks · 18 open · linked to assessments, evidence and contracts
| ID | Risk | Provider | Severity | Status | Owner |
|---|---|---|---|---|---|
| RSK-311 | DR testing evidence not provided | Halcyon | High | Mitigation Planned | S. Martin |
| RSK-318 | Exit strategy absent from contract | Northwind Cloud | High | Open | T. Weber |
| RSK-324 | Subcontractor countries incomplete | Payflux | Medium | In Review | L. Dubois |
| RSK-327 | Pen test older than 12 months | Lumendata | Medium | Open | S. Martin |
| RSK-330 | No documented incident SLA | Valtera | Low | Accepted | M. Rossi |
Workflow
The continuous review loop.
Get your ICT third-party risk under control.
See how one platform connects your ICT providers, assessments, evidence, contracts, risks and DORA Register.