What clients ask you for
Insurance, DPA, ISO 27001 or Cyber Essentials, sub-processor list, business continuity summary. Keep these live in Credbase and every RFP response takes minutes.
What you should ask your own vendors for
The mirror image. Freelancers: PI insurance and DPA. SaaS: SOC 2 or ISO 27001 and sub-processor list. Cloud infrastructure: security whitepaper and DPA.
A right-sized programme
- Register your top 20 vendors.
- Tier them by data sensitivity.
- Request core evidence via upload link.
- Set expiry reminders.
- Review annually, 30 minutes per tier 1.
Frequently asked questions
Your next step
Two ways to act on this guide right now - one hands-on, one to read next.
A one-page template for what a proper client evidence pack should contain. Pick the sections that apply and copy the outline.
Open the toolA pragmatic, right-sized guide to third-party risk management (TPRM) for teams that don't have a full risk function, with tiering, evidence packs and continuous monitoring.
Read the guidePut this into practice today.
Start a free Credbase workspace, add your first supplier and share a live document pack in ten minutes.