Platform · Vendor management
NIS2 (art. 21.2(d)) requires supply chain security to be managed. DORA (art. 28) requires financial entities to manage ICT third-party risk and to keep a register of arrangements with ICT service providers. In EVIDEVO each vendor has services, data processed, criticality, risk assessment, contract and deadlines. Questionnaires are sent from the platform and the vendor answers directly, with attachments.
Data for illustrative purposes only, not real
The problem
Spreadsheets sent out, manual reminders, answers in different versions.
It is unclear which vendors are critical and which assessments have expired.
NIS2 and DORA require proof of how ICT providers are assessed and monitored over time.
What it does
Services, data processed, criticality and available alternatives.
The vendor answers in EVIDEVO, with attachments and a deadline, and receives an automatic reminder before it.
A level per vendor, with findings and agreed actions.
Contracts, certifications and assessments, with alerts before expiry.
Evidence received from vendors is linked to the NIS2 and DORA supply chain controls.
Exportable for authorities, auditors and the management body.
The outcome
Other capabilities
It starts from the frameworks in scope and how the work is organised today. In thirty minutes, EVIDEVO is shown working in that context.