Vendor risk, because their breach becomes your breach.
Every vendor with access to your PHI is part of your attack surface — and your liability. We stand up the third-party risk program that tiers, assesses and monitors them, so a subprocessor's mistake doesn't become your headline.
Not every vendor is the same risk
A vendor with deep PHI access deserves far more scrutiny than the one that prints your stationery. We tier by the risk they actually carry and right-size the assessment to match.
Critical
Deep PHI accessVendors processing PHI or core to operations. Full assessment, a signed BAA, continuous monitoring and a documented exit plan.
High
Sensitive dataAccess to sensitive data or important systems. A thorough assessment and a periodic review cadence.
Moderate
Limited accessLimited or indirect data access. A right-sized questionnaire and a lighter monitoring cadence.
Low
No sensitive dataNo access to sensitive data. Baseline due diligence up front, then monitored for any change in scope.
Vendor risk judged by people who know the systems
We assess third parties the way an engineer reads an architecture — for what could actually go wrong, not whether a box on a form is ticked.
We know what a vendor with PHI access can actually do to you — because we build the systems they plug into.
Assessment matched to the risk a vendor carries, so effort goes where the exposure is.
Necessary but not sufficient — we pair the agreement with real assessment and monitoring.
Security ratings and change alerts, not a questionnaire that's stale the day it's filed.
How the program works
From discovering every vendor to monitoring them continuously — a third-party risk program that's tiered, assessed and actually maintained.
Start a conversation
01Vendor inventory & tiering
We find every third party with access to your data or systems — including the ones nobody remembered — and tier each by the risk it actually carries.
- Full vendor discovery
- Data-access mapping
- Risk tiering
- Shadow-IT sweep
02Risk assessment
We assess each vendor to the depth its tier demands — security questionnaires, evidence review and a real read of their SOC 2 or HITRUST report, not just its cover page.
- Tiered questionnaires
- Evidence review
- SOC 2 / HITRUST analysis
- Findings & risk rating
03Remediation & contracts
We turn findings into action — BAAs and security terms in the contract, remediation tracked with the vendor, and risk accepted only with eyes open.
- BAA & security terms
- Remediation tracking
- Risk acceptance
- Data-handling controls
04Continuous monitoring
Vendor risk isn't a point in time. We monitor for breaches, posture changes and certification lapses, and re-assess on a cadence matched to each tier.
- Security ratings
- Breach alerts
- Re-assessment cadence
- Reporting & dashboards
What a real vendor assessment looks at
Security posture
How a vendor protects the data and access you're handing them.
- Controls maturity
- Access & encryption
- Testing & patching
- Known weaknesses
Data handling & PHI
What they do with your data, where it lives and who can see it.
- Data flows
- PHI handling
- Residency
- Retention & deletion
Compliance & certifications
The reports they hold — and what's actually inside them.
- SOC 2 review
- HITRUST / ISO
- Scope & exceptions
- Bridge letters
Subprocessors
The fourth parties your vendor relies on, and their risk in turn.
- Subprocessor list
- Fourth-party risk
- Data-sharing chains
- Notification terms
Business continuity
Whether they'd stay standing — and recoverable — in a crisis.
- Continuity plan
- DR & backups
- Resilience testing
- Dependency risk
Incident history
Their track record, and how they'd tell you if it happened again.
- Breach history
- Notification SLAs
- Response maturity
- Lessons learned
When the supply chain becomes the risk
A sprawling vendor list, an audit that demands a program, or a vendor breach that just made it real — the fix is the same: visibility and control.
A vendor list that's outgrown the spreadsheet
You've accumulated dozens of vendors with access to your systems and data, and no one can say with confidence who can reach what. We bring the whole supply chain into view and under control.
- Full inventory
- Risk-tiered view
- Closed visibility gaps
- Ongoing control
TPRM is now a requirement
SOC 2, HITRUST and enterprise customers all expect a real third-party risk program. We stand one up that satisfies the requirement and genuinely reduces your exposure.
- Audit-ready program
- Evidence & records
- Policy & process
- Customer-shareable
A vendor got breached
One of your vendors had an incident, and suddenly the question is which others could do the same. We assess the blast radius and harden the program so the next one doesn't reach you.
- Exposure assessment
- Rapid re-tiering
- Program hardening
- Board reporting
A spreadsheet is not a program
Most organizations “do” vendor risk in a spreadsheet that was last accurate a year ago. That's a list, not a defense.
A tab of vendor names and renewal dates that was accurate the day it was made. No tiering, no assessment depth, and no idea when a vendor's posture changes.
- Static and stale
- No risk tiering
- Assessment never happens
- Blind to changes
A living third-party risk program where every vendor is tiered, assessed to the right depth, and continuously monitored — with the records to prove it to an auditor or your board.
- Risk-tiered
- Assessed by tier
- Continuously monitored
- Auditable record
The vendor lifecycle, managed end to end
Find every vendor with access to data or systems.
Rank each by the risk it actually carries.
Evaluate to the depth the tier demands.
Close gaps and put terms in the contract.
Watch for breaches and posture changes.
Retire access cleanly when a vendor leaves.
Vendor-risk principles we run by
The convictions that turn vendor risk from a compliance chore into a real reduction in the exposure your supply chain carries.
Tier by real risk
A vendor with deep PHI access and one that prints your letterhead are not the same problem. We scope effort to exposure.
Assess what matters
We read the SOC 2, not just collect it — and ask the questions that surface real risk instead of filling a form.
Trust, but verify
Attestations are a starting point, not an answer. We verify the controls a vendor claims actually exist.
Watch the fourth party
Your vendor's vendors are your risk too. We follow the chain to the subprocessors that actually hold your data.
Continuous, not annual
Risk changes between reviews. We monitor continuously so a vendor's breach isn't news to you months later.
Plan the exit
Every critical vendor needs an offboarding and access-revocation plan before you need it, not after.
Vendor risk management FAQ
Isn't a signed BAA enough?
No. A BAA is a legal requirement and a starting point, but it doesn't tell you whether a vendor's security is actually any good. OCR and your customers expect you to assess and monitor your business associates, not just sign with them — the agreement and the program go together.
How many of our vendors should we assess?
All of them, but not equally. We tier your vendor population so the deep, evidence-heavy assessments go to the critical vendors with PHI access, while low-risk vendors get baseline due diligence. That's how you get real coverage without drowning your team.
Do you provide continuous monitoring?
Yes. We use security-rating services and breach monitoring to watch vendor posture between formal reviews, and we re-assess on a cadence matched to each vendor's tier — so a vendor's degradation or breach surfaces quickly.
Does this satisfy SOC 2 or HITRUST?
Yes. Third-party / vendor risk management is an explicit control area in both SOC 2 and HITRUST, and enterprise security reviews ask about it directly. We build the program and keep the evidence those processes require.
Who owns the program after you build it?
Your choice. We can run it as a managed service, or stand it up, document it and hand over a program your own team operates — with the tooling, templates and cadence already in place.
Do you actually know who can reach your PHI?
Tell us roughly how many vendors you work with. We'll show you how to bring them into view, tier them by risk, and keep them there.
Talk to our team