Third-party risk, scored, assessed, and auditable.

Maintain a searchable register of every supplier. Create records with legal name, classification (Critical, Important, Standard), service description, primary contact, and review frequency. Onboard existing vendor lists in minutes via CSV import with field mapping.

Each supplier is scored automatically: Dependency (x0.4), Penetration (x0.3), and Exposure (x0.3). The composite 1-5 score is colour-coded (green, yellow, red) so procurement, risk, and compliance align on tiering without spreadsheets. Scores refresh annually or when scope changes.

Acuna scans every supplier's online presence across DNS configuration, TLS certificates, web security headers, data breach exposure, and reputation. Each supplier receives a composite A-F grade visible in the list and detail views. Scans run automatically when you save a supplier with a domain, or trigger manually from the Risk Exposure tab. Drill down into individual findings with severity levels and evidence.

Launch the same questionnaire to multiple suppliers at once. Select suppliers with full filtering, choose a template, preview the email, and launch. Set a planned start date to schedule campaigns for automatic future launch. The campaign dashboard tracks progress with status badges, completion percentages, and rating summaries. Choose which contact receives the email for each supplier before launching.

When reviewing assessment responses, click Ask Aiko to evaluate to have AI analyse all questions, including uploaded evidence documents, images, and PDFs. Aiko provides evaluation suggestions with confidence scores you can review and adjust before finalising. Real-time progress is shown as Aiko works through each question, and you can cancel at any time.

Suppliers complete questionnaires and upload documents through a dedicated portal. No Acuna account needed. Submissions flow directly into the IRP with a defensible trail. Evidence stays out of inboxes, and auditors get a documented response chain they can follow. Portal links are preserved when returning assessments for corrections.

Each supplier opens into a unified detail panel, identical whether accessed from Supplier Shield or Implement, Third Parties. Shows core information, OSINT scan results, risk dimension controls, workspace contacts, all related objects (processes, risks, controls, KPIs) grouped by type with health badges, assessment data, and the immutable activity log.

Store unlimited contacts per vendor with role designations: Primary, Technical, Billing, and Support. Contacts feed into assessment notification distribution lists. Choose which contact receives campaign emails before launching. Archive outdated contacts instead of deleting to preserve the audit trail.

Suppliers show all related objects (processes, risks, controls, KPIs) grouped by type with health and status badges. The interactive process map displays supplier nodes with colour-coded tier badges, fullscreen toggle, and dark mode support. Critical processes are flagged for priority monitoring.

Critical suppliers can require approval for risk score adjustments. Configure approval workflows in Admin, Workflow Designer so changes on high-tier vendors route through designated approvers before taking effect, giving you a governed process for risk reclassification.

Dependency

How critical is this supplier to business continuity? Core services score high; commodity or easily replaceable suppliers score low.

Penetration

How deeply integrated is the supplier into your IT, data, or processes? Deep system access scores high; isolated services score low.

Exposure

What is the potential impact of a supplier breach, outage, or failure? Financial, operational, and reputational impact drives the score.

DNS Configuration

Checks SPF, DKIM, DMARC, DNSSEC, and MX records to assess email authentication and domain security posture.

TLS Certificates

Validates certificate chain, expiry dates, protocol versions, and cipher strength to flag weak or expired encryption.

Web Security Headers

Scans for HSTS, Content-Security-Policy, X-Frame-Options, and other HTTP security headers that protect against common web attacks.

Data Breach Exposure

Checks if the supplier domain or associated email addresses appear in known data breach databases, with severity classification and exposure timeline.

Reputation

Aggregates reputation signals across threat intelligence sources, blocklists, and web trust indicators to assess overall supplier trustworthiness.

Core Information

Workspace Contacts

OSINT Security Grade

Related Objects

Assessment Data and AI Evaluation

Structured TPRM workflows

Compliance context linking

Centralise vendor risk alongside your control framework.

For security leaders who need third-party risk visible next to controls, frameworks, and the risk register instead of in a disconnected spreadsheet.

Run assessment cycles without manual follow-up.

For TPRM owners who need repeatable campaign workflows (from questionnaire distribution through AI-evaluated responses) without chasing email threads.

Prove vendor governance to regulators and auditors.

For compliance teams that need to demonstrate a structured TPRM programme with scored suppliers, documented assessments, and a clear audit trail.

Acuna calculates a composite score from three weighted dimensions: Dependency (x0.4) measures how critical the supplier is to business continuity, Penetration (x0.3) measures how deeply integrated the supplier is into your IT, data, or processes, and Exposure (x0.3) measures the potential impact of a supplier breach or failure. The result is a colour-coded 1-5 score: green (1-2), yellow (2.5-3.5), red (4-5). Scores are reviewed annually or when supplier scope changes materially.

You create a campaign by selecting a questionnaire template and choosing which suppliers to include. Set a response deadline and reminder schedule, then launch. Acuna sends questionnaires to supplier contacts automatically, tracks response rates, and lets you resend reminders to non-responders. Campaigns consolidate third-party evaluation into a repeatable rhythm aligned with your audit calendar.

Each supplier's detail panel shows the full IRP: core information (name, classification, risk score, review frequency), workspace contacts (primary, technical, billing, support), linked business processes with impact flags, assessment data with response status, and an immutable activity log. The activity log tracks every field update, contact change, assessment action, and process linkage with the actual user name and timestamp.

Yes. Suppliers use a dedicated portal to complete questionnaires and upload documents. They receive a link, respond externally, and their submissions flow back into the IRP with a defensible submission trail. No separate login or licence is needed for the supplier.

Yes. Critical suppliers can require approval for risk score adjustments. Configure approval workflows in Admin, Workflow Designer so score changes on high-tier vendors route through designated approvers before taking effect.

There is no limit. Each supplier record supports multiple contact records with role assignments (Primary, Technical, Billing, or Support). Contacts feed into assessment notification distribution lists, and archiving outdated contacts preserves the audit trail instead of deleting history.

Each questionnaire response moves through Not Sent, In Progress, Submitted, Complete. Campaign dashboards show response rates per status so you can identify non-responders at a glance and resend reminders without leaving the view.

The scanner checks five dimensions: DNS configuration (SPF, DKIM, DMARC, DNSSEC, MX), TLS certificates (chain validity, expiry, protocol, cipher), web security headers (HSTS, CSP, X-Frame-Options and others), data breach exposure (domain and email addresses in known breach databases), and reputation (threat intelligence sources, blocklists, web trust signals). Results produce a composite A-F grade with drill-down into individual findings.

Scans run automatically when you save a supplier record with a website domain. You can also trigger a manual re-scan at any time from the Risk Exposure tab in the supplier detail panel. Scan results are stored historically so you can track improvements or regressions over time.

When reviewing supplier assessment responses, click Ask Aiko to evaluate to have Acuna's AI analyse all questions, including uploaded evidence documents, images, and PDFs. Aiko provides evaluation suggestions with confidence scores that you can review and adjust before finalising. Real-time progress is shown as Aiko works through each question, and you can cancel at any time.

Yes. When creating a campaign, you can set a planned start date. The campaign shows a Scheduled badge in the list. When the date arrives, the system automatically launches it and sends emails to all supplier contacts. Campaigns without suppliers assigned are skipped until suppliers are added.