Give DPS the agreed onboarding, chasing and evidence-administration work, so your team can focus on business decisions and material exceptions.
DPS professional servicesSupplier Risk Management.
Supplier Risk Management.
Expertise that keeps it moving.
Give your supplier assurance programme an experienced team and a structured workspace. DPS can coordinate onboarding, questionnaire completion, evidence review and risk follow-up on your behalf.
Very competitively priced · Price on application
Annual and monthly payment options available
Software and specialist supportYour programme.
Your programme.
A managed process.
Agree the supplier scope, responsibilities, review frequency and decision authority. DPS runs the contracted due-diligence activities in Supplier Security Workspace, with a visible trail of progress, findings and escalations.
See the workspace behind the service ↗Benefits for your organisationFree up your team.
Reduce the coordination burden Apply a consistent approach Make progress visible
Free up your team.
Keep control of the decisions.
Review suppliers against defined scope, criticality and evidence requirements. Record uncertainty, challenge gaps and escalate findings within agreed thresholds.
See the status of responses, reviews and actions in the workspace, supported by dated reports, clear ownership and an auditable history.
An agreed service, built around your needs01 02 03 04 05 06
From setup to recurring review.
Onboarding and setup
Configure the agreed workspace, business context, branding and templates. Organise supplier records, nominated contacts and initial invitations.
Supplier coordination
Manage the agreed questionnaire requests, completion follow-up, confidentiality workflow and clarification, with the client represented clearly.
Evidence-led review
Review supplied evidence and public-source material within the contracted scope. Identify missing, dated or restricted assurance and prepare contextual risk findings.
Decisions and escalation
Prepare recommendations and refer approvals to your authorised decision-makers. DPS makes approval or risk-acceptance decisions only under specific written delegated authority.
Risk and action follow-up
Coordinate agreed treatments, supplier updates and evidence requests. Record progress and refer closure or residual-risk decisions to the appropriate authority.
Reporting and ongoing assurance
Provide the agreed reporting and review cycle. Use the workspace to track renewals, Tier 1 findings and relevant Threat Intelligence requiring assessment.
A practical response to real obligations
EU GDPR: Articles 24, 28 and 32 ↗
DORA: ICT third-party risk ↗
ISO/IEC 27701 ↗
Why supplier assurance matters.
When you depend on a supplier, you still need to understand and oversee the risk to your organisation and the people whose information you hold.
UK and EU GDPR
Controllers using processors must choose providers offering sufficient guarantees and put appropriate processing terms in place. Risk-appropriate security, documented accountability and continuing oversight support that decision. A questionnaire is a starting point; the evidence and follow-up matter.
ICO: processor due diligence ↗EU GDPR: Articles 24, 28 and 32 ↗
NIS2 and DORA, where applicable
NIS2 supply-chain security measures apply to entities within its scope through applicable national law. DORA requires in-scope financial entities to manage ICT third-party risk. The depth of assessment and contractual oversight depends on your organisation, services and obligations.
NIS2: Article 21 ↗DORA: ICT third-party risk ↗
ISO 27001 and ISO 27701
A risk-based supplier process supports information security and privacy management: define relevant requirements, assess relationships, review evidence and monitor change. It helps connect supplier decisions with your management system and audit trail.
ISO/IEC 27001 ↗ISO/IEC 27701 ↗
Resilience and good practice
Look beyond a supplier’s headline certification. Consider the exact service, access, data, dependencies, recovery commitments and evidence gaps. Proportionate ongoing review helps your team recognise changes and decide what needs action.
NCSC: supply-chain security principles ↗Applicability must be checked for your organisation. These obligations do not prescribe a particular software product. The workspace and managed service support an accountable process; they do not themselves confer compliance, certification or freedom from incidents. The ICO notes that some guidance is under review following the Data (Use and Access) Act 2025.
Accountability stays visibleClear authority.
Clear authority.
Documented boundaries.
The engagement sets out the supplier population, activities, review frequency, responsibilities and fees. It identifies which decisions DPS can take and which must be escalated to you.
Your organisation retains its procurement and controller responsibilities. DPS records the agreed work and evidence gaps; it cannot compel a supplier to respond or guarantee that a supplier will remain secure.
Personal-data processing, confidentiality and handover are governed by the agreed service and data processing terms.
Start with the work you need help with.
Choose initial setup, a defined supplier-review programme or an ongoing managed service. We will agree the scope and support level with you.
Very competitively priced.
Annual and monthly payment options.
Price on application.
Move supplier assurance
from backlog to a working process.
Tell us about your suppliers, deadlines and internal capacity. We will discuss a practical service around your priorities.