Chandler Supplier and third-party risk management
Know who you depend on, what happens if they fail, and whether they are as careful as you are.
NIS2 made supply-chain security explicit: you are responsible for the security of the suppliers and service providers your operation depends on. That is uncomfortable, because most organisations have never written the list down.
Chandler is that list, kept properly. Each supplier is recorded with what they provide, what access they have, how critical they are to you and what the contract says about security. Where a supplier can reach your systems, that access is tied to the record, so the question 'who can get in?' has one answer rather than three.
It also carries the assessment: what you asked for, what they hold in the way of certifications, which security clauses are actually in the contract, and what was accepted or left as a gap, all with dates and a named reviewer. Each supplier has a review cadence, so the critical ones come round again and show as due or overdue rather than being filed once.
And when the supplier is the one having the incident, the record is what tells you how exposed you are and who to call, while it is happening, not afterwards.
What Chandler does
One supplier register
What each supplier provides, how critical they are, and what the contract requires.
Access, tied to the record
Third-party access is visible from the supplier entry and revocable from it.
Assessments on a cadence
Questionnaires, responses and accepted risks, repeated for the suppliers that matter.
Ready for their bad day
When a supplier is breached, the register tells you your exposure and who to contact.
- A maintained supplier and service-provider register with criticality and contacts
- Security requirements and assessment outcomes recorded per supplier
- Third-party access visible and revocable from the same record
- Exportable supply-chain evidence for audits and customer questionnaires
Supply-chain security, including the security of relationships with direct suppliers and service providers.
And IMO maritime cyber resilience: IACS UR E26/E27
IACS UR E26 §3 / E27 §4: supplier and integrator responsibilities, and the documentation they must provide for on-board systems.
Works closely with
These are the capabilities Chandler shares its facts with.
Want to see Chandler on your own estate?
We will walk you through it against your actual sites, machines and obligations, and tell you where it would make no difference.