Cybervize
TPRM module of OdySecure, Cybervize's security platform

Third-party risk management software for suppliers and the outsourcing register

Assess vendors, keep contracts register-ready, expose subcontractor chains, calculate concentration risk daily and plan the exit. Built along the EBA outsourcing requirements, on one data layer with ISMS, BCM and Assessment. Hosted in Germany.

Book a free demo

What the supplier register looks like

Every supplier with category, risk tier, score, active contracts and assessments. From the software, not a mock-up.

Supplier register in OdySecure: seven suppliers with category, risk tier, risk score, status, contracts and assessments

What the TPRM module covers

Third-party risk is a question of evidence: who is critical, why, what does the contract say and what happens when the provider fails? The module answers that from maintained data instead of a spreadsheet nobody keeps current.

Criticality with a traceable calculation

Eight mandatory factors per vendor: four impacts from 1 to 5 (financial, continuity, operational and legal, reputation) and four yes-no questions (authorised activities, internal control function, approval requirement, BRRD criticality). From these the system derives the rating standard, important or critical, with fixed escalation logic: an approval requirement or BRRD criticality always leads to critical. The AI suggests a rating with reasoning per factor; people decide.

An outsourcing register that survives the audit

19 mandatory fields per contract, among them arrangement type, function category, notice periods, countries of data processing, annual cost, substitutability and reintegration time. From these the platform produces an exportable register snapshot as JSON or CSV for supervisors; notifications to authorities are documented with timestamp and note. Contracts run through the states draft, active, expiring, expired.

AI contract analysis as screening

The AI reads the contract PDF and extracts SLA commitments, liability caps, audit rights, data protection clauses and exit provisions, checked against your configurable requirement policies. Every finding goes into a manual review where it is confirmed or corrected. This is a screening tool and does not replace legal review.

Subcontractor chains in depth

Multi-level chains with server-calculated chain depth and automatic cycle detection, so circular relationships surface instead of staying hidden. Changes to a chain run as a request with approval, objection or withdrawal, not as a silent edit.

Due diligence and audit evidence

Structured review of business model, financial strength, ownership structure and regulatory status, extended for critical functions by continuity planning, internal controls and ESG. Outcome: pass, pass with conditions, fail. Third-party evidence such as ISO 27001, SOC 2 or pentest reports is validated against scope coverage, recency, recognised standards and individual audit rights.

Monitoring, concentration and exit

Periodic reviews with KPIs, KCIs and SLAs whose thresholds are checked directionally, plus automatic review scheduling. The concentration ratio is calculated daily per vendor and tracked in levels from low to critical. Exit strategies record triggers, resource and cost estimates, duration and the link to the BCM plan.

No CISO of your own?

In a vCISO mandate, your vCISO works with OdySecure and the platform is included. From €3,600/month.

Book an intro call vCISO in detail
More about the TPRM module

The regulatory frame of the TPRM module

The module is built along the EBA outsourcing requirements, paragraph by paragraph. What is a draft, we call a draft. The reason to steer suppliers at all does not depend on financial supervision, though: ISO 22301 ties partners and suppliers to time-critical activities and requires them to be included in continuity solutions and response planning. That holds for a hospital as much as for a bank.

  • EBA outsourcing requirements (CP/2025/12, draft): criticality §33 to §37, contracts §63 to §67, concentration §76, due diligence §80 to §83, subcontractors §88 to §96, audits §97 to §108, monitoring §111 to §116, exit §117 to §119
  • NIS-2 supply chain obligation as the trigger: vendor risks are linked to assets, risks and incidents in the ISMS module and can therefore be evidenced
  • Third-party evidence as review objects: ISO 27001, SOC 2, TISAX and pentest reports are checked for scope, recency and recognised standards
  • GDPR link: countries of data processing are a mandatory register field, processing agreements and third-country transfers are documented
  • Further requirements, for instance sector-specific ones, can be integrated the same way: load the catalogue, maintain the mapping, activate
50frameworks as a catalogue in the platform:standards and frameworks, regulatory requirements, requirement records per entry.See the full list

Who the TPRM module is built for

Three constellations in which the vendor list in a spreadsheet becomes a liability question.

Outsourcing officers and compliance

Own the register towards supervisors and must be able to export at any time. 19 mandatory fields per contract, a register snapshot at the push of a button, documented authority notification with timestamp instead of a folder full of contracts and emails.

Risk owners in the group

See individual vendors but not the cluster risk behind them. A daily concentration ratio per vendor, substitutability from easy to impossible and subcontractor chains with depth calculation make visible what operations depend on.

CISOs with the NIS-2 supply chain obligation

Must evidence that vendor risks are managed, not just asserted. Critical ratings automatically create threat scenarios in the BCM module, vendor risks hang on assets and incidents in the ISMS. The evidence emerges from operations.

FAQ about the TPRM module

How is the outsourcing register produced and how does it reach supervisors?▼
The register is not a separate document; it emerges from maintained contracts. Every contract carries the 19 mandatory fields, from arrangement type through notice periods and function category to countries of data processing, annual cost, substitutability and reintegration time. From these the platform generates an exportable register snapshot as JSON or CSV. Notifications to supervisors are documented with timestamp and note on the contract, so it stays traceable who reported what and when.
How is criticality calculated, and what exactly does the AI do?▼
The rating follows a fixed calculation, not a gut feeling: four impact factors from 1 to 5 (financial, continuity, operational and legal, reputation) and four yes-no factors (authorised activities, internal control function, approval requirement, BRRD criticality). Escalation is fixed: an approval requirement or BRRD criticality forces the critical level, high impact leads to important. The AI suggests a rating with reasoning per factor so nobody faces an empty form. The responsible person decides, and the reasoning stays readable on the record.
EBA CP/2025/12 is a draft. What does that mean for us?▼
It means we already implement the requirements of the consultation paper while the final text is still pending. The upside: whoever works to this structure today already keeps register, criticality assessment and chains in the shape the market is moving towards. If the final text changes something, that is catalogue maintenance for the platform rather than new development, because requirements are integrated as data. We label the draft status deliberately instead of claiming a finished rulebook.
How deep are subcontractor chains mapped?▼
Multi-level, with server-calculated chain depth per link. The system detects cycles automatically, meaning circular relationships where providers list each other as subcontractors. Changes to a chain are not a silent entry but run as a request with approval, objection or withdrawal. That keeps it traceable who introduced which subcontractor and when, and you see the chain rather than only the contracting party on the surface.
How is concentration risk calculated?▼
Daily, per vendor, as a concentration ratio between 0 and 1, tracked in levels from low to critical. It is complemented by substitutability from easy to impossible. The combination answers the question that counts in an emergency: how much of the operation depends on this single provider, and how quickly could we replace them? For exit planning there are triggers, resource and cost estimates, estimated duration and the link to the BCM plan.
What happens when a vendor is rated critical?▼
The rating does not stay inside the TPRM module. A vendor rated critical automatically creates a threat scenario in the BCM module, so the outage lands in continuity planning rather than a side file. Vendor risks are linked to risks and assets in the ISMS module, and the cross-module impact analysis shows which assets, risks and incidents depend on that provider. That is exactly why the modules share one data layer.

TPRM is one module of OdySecure

The TPRM module shares the data layer, permission model and audit trail with the ISMS (ISO 27001), BCM (ISO 22301) and Assessment modules. That is exactly where the cross-links come from: a vendor rated critical creates a threat scenario in BCM, exit strategies link to BCM plans, and the ISMS asset dependency graph shows which systems depend on that provider. Licensing is modular: you can start with TPRM and extend when needed.

See the full platform

Memberships, programmes and partnerships

  • BSI Allianz für Cyber-Sicherheit
  • CISPA Helmholtz-Zentrum für Informationssicherheit
  • TeleTrusT - Bundesverband IT-Sicherheit
  • IT Security Made in Germany - TeleTrusT