DPS Compliance Hub · Supplier Security Workspace

Know your suppliers.
Understand your exposure.

Turn supplier questionnaires, public-source checks and evidence into clear risk decisions. Give your team one place to assess suppliers, agree actions and keep assurance current.

Arrange your demonstration Download the brochure

Very competitively priced · Price on application
Annual and monthly payment options · 12- or 24-month licences

Watch the workspace overview · 3 min 25 sec
Optional English captions

A clearer way to manage third-party risk

Less fragmented administration.
More informed decisions.

Your suppliers support critical services, handle information and depend on software of their own. The workspace helps you see that picture, challenge the evidence and record an accountable decision.

Focus your effort

Search and filter the portfolio. Find high-risk suppliers, approaching reviews, overdue actions and assurance evidence needing renewal.

Explain the decision

Bring business context, responses and evidence into a structured report with a risk rationale, section ratings and recorded approval.

Keep work moving

Give suppliers clear requests and classified actions, with ownership, status, due dates and a review trail.

Why choose Supplier Security Workspace?

Make supplier risk
a business decision.

A completed questionnaire is only the beginning. Your team needs to understand what matters, challenge the evidence and show why a supplier relationship is acceptable.

Protect the services you depend on.

A supplier outage or security incident can affect your own operations and the people you serve. Assess the exact service, business impact, data exposure and downstream dependencies so that review effort follows the risk.

Make procurement decisions you can explain.

Bring public-source checks, supplier responses and supporting documents together. Review the rating rationale, identify what remains unknown and retain an attributable approval decision with its conditions and follow-up.

Support your legal and assurance obligations.

UK and EU GDPR require controllers using processors to select providers offering sufficient guarantees. Proportionate supplier oversight also supports ISO 27001 and ISO 27701, and supply-chain requirements under NIS2 or DORA where those regimes apply.

Read the legal context and primary sources ↗

Spend less time coordinating the process.

Give suppliers clear requests, evidence uploads and classified actions. Keep owners, deadlines, renewals and review progress visible in one place. Run the programme with your own team or add DPS onboarding and managed due-diligence support.

The right review for the relationship

From first checks to ongoing assurance.

Outside-in assessment

Evaluate publicly available assurance against the proposed service. Record attributable evidence, uncertainty and procurement recommendations before seeking an approval decision.

Supplier questionnaire

Collect scoped answers, software dependencies, certifications, insurance details and supporting evidence. AI assists the review; your authorised team validates the outcome.

Tier 1 review

Assess major providers using service-specific public and permitted contractual evidence. Review availability commitments, responsibilities and recovery gaps, with weekly review and public status checks.

Risks and actions

Classify treatments as mandatory, preferred or optional guidance. Track ownership and dates, record supplier progress and retain client verification.

Evidence and renewal

Keep documents and certification history together. Identify approaching expiry or review dates, with recorded supplier reminders from the authorised sender.

Leadership reporting

Use prominent supplier ratings, executive summaries and section-level conclusions. Produce dated management presentations and retain historical report snapshots.

Your security posture

Complete your own organisation assessment without using supplier allowances. Review internal controls alongside the supply network and export your responses and risk overview.

Private prospective-client review

Grant temporary, signed-in access to your approved security posture, questionnaire and selected evidence. Use the NDA-first workflow and retain access and deletion follow-up records.

Bring existing assessments

Import CSV or Excel questions and answers with service, criticality and processing context. Preserve the source and use it to support an evidence-led review.

A practical response to real obligations

Why supplier assurance matters.

When you depend on a supplier, you still need to understand and oversee the risk to your organisation and the people whose information you hold.

UK and EU GDPR

Controllers using processors must choose providers offering sufficient guarantees and put appropriate processing terms in place. Risk-appropriate security, documented accountability and continuing oversight support that decision. A questionnaire is a starting point; the evidence and follow-up matter.

ICO: processor due diligence ↗
EU GDPR: Articles 24, 28 and 32 ↗

NIS2 and DORA, where applicable

NIS2 supply-chain security measures apply to entities within its scope through applicable national law. DORA requires in-scope financial entities to manage ICT third-party risk. The depth of assessment and contractual oversight depends on your organisation, services and obligations.

NIS2: Article 21 ↗
DORA: ICT third-party risk ↗

ISO 27001 and ISO 27701

A risk-based supplier process supports information security and privacy management: define relevant requirements, assess relationships, review evidence and monitor change. It helps connect supplier decisions with your management system and audit trail.

ISO/IEC 27001 ↗
ISO/IEC 27701 ↗

Resilience and good practice

Look beyond a supplier’s headline certification. Consider the exact service, access, data, dependencies, recovery commitments and evidence gaps. Proportionate ongoing review helps your team recognise changes and decide what needs action.

NCSC: supply-chain security principles ↗

Applicability must be checked for your organisation. These obligations do not prescribe a particular software product. The workspace and managed service support an accountable process; they do not themselves confer compliance, certification or freedom from incidents. The ICO notes that some guidance is under review following the Data (Use and Access) Act 2025.

Make participation easier

A clearer process for your suppliers.

Suppliers can save progress, explain applicability, provide evidence and see the work assigned to them. Their own questionnaire answers can be exported for reuse, while support and training help them complete the process.

Clear requests and visible decisions help reduce avoidable clarification and make it easier for both teams to follow up the right issues.

Choose the support you need.

Run the workspace with your own team, add onboarding and setup assistance, or ask DPS to manage the agreed supplier due-diligence process for you.

Explore Supplier Risk Management ↗

Managed services are separately scoped and very competitively priced, with annual and monthly payment options. Price on application.

A licence for your supplier programme

Four levels. Clear annual allowances.

Choose a 12- or 24-month commitment, with annual or monthly payments agreed in your order. Assessment usage is visible, with threshold alerts before either allowance is exhausted.

Very competitively priced.
Price on application.

Level	Outside-in / year	Standard / year
1	20	40
2	40	60
3	60	100
4	100	200

New assessments and reassessments consume an allowance when created. Editing, regenerating an AI draft and exporting do not consume another unit. Tier 1 weekly monitoring is separate. Monthly payments are instalments for the agreed licence commitment.

See the difference for your organisation

Build a supplier programme
your team can explain.

Discuss your supplier population, review priorities and the support that would help you move forward.