Bearlink · Supplier workflow
One shared workflow for Procurement, the CISO and Legal to decide on your suppliers
By Steven Carrier Updated on
Supplier risk management brings three functions together around the same file: Procurement onboards suppliers and handles contracts, the CISO assesses cyber exposure, and Legal checks the obligations. Bearlink gives them a shared workflow, from onboarding to follow-up: verified documents, due diligence proportionate to criticality, cyber exposure observed from the outside, a recorded decision and a tracked action plan.
- Procurement, CISO and Legal on the same record
- Criticality-based due diligence
- Developed in France
Three functions, three spreadsheets, no shared decision
Supplier risk cuts across three functions that rarely work together. Procurement keeps spreadsheets and sends reminders, the CISO sends out security questionnaires, Legal checks the clauses on its own. The result: incomplete files, decisions taken without the cyber view, and no shared record of who approved what.
- Procurement
- CISO
- Legal
The same supplier record
Procurement, CISO, Legal: who does what?
Every function reads the same supplier record. Procurement manages onboarding, the contract and reminders. The CISO qualifies cyber exposure and security requirements. Legal interprets the obligations and rules on waivers. Under NIS2 and DORA , supplier cyber risk has become a shared concern.
| Function | What it contributes | What it reads in Bearlink |
|---|---|---|
| Procurement | Onboarding, contract, reminders, file completeness | Procurement report focused on compliance and contract |
| CISO | Security requirements, assessment of cyber exposure | Cyber report focused on the attack surface |
| Legal and compliance | Interpretation of obligations, clauses, ruling on waivers | Questionnaires, supporting documents and document tracking in the supplier record |
| Senior management | Final decision on critical suppliers | Summary for senior management |
Complete onboarding before signature
Onboarding starts with a single record per supplier. The supplier uploads its documents to a dedicated portal, with automatic reminders. Certificates are tracked until expiry and archived. The file is complete before signature, not three months later.
- Single record per supplier
- Supplier portal
- Automatic reminders
- Expiry tracking and archiving
How should due diligence match the supplier’s criticality?
Not every supplier deserves the same attention. Criticality, defined by what the supplier is used for, its access to your data and how dependent you are on it, sets the level of due diligence. An office supplies vendor is not handled like a managed IT services provider: depth follows criticality.
| Criticality | Expected due diligence |
|---|---|
| Standard | Mandatory compliance documents, verified and tracked until expiry; cyber assessment as seen from the outside |
| Significant | In addition: tailored due diligence questionnaires, sanctions screening, IBAN checks |
| Critical | In addition: full attack surface monitoring with Beareye’s EASM module, tracked action plan, enhanced review |
Tailored questionnaires, backed by evidence
Depending on the level of due diligence, the supplier answers the relevant questionnaires: the French anti-corruption law (Sapin II), the French corporate duty of vigilance law, CSR, GDPR, NIS2 or DORA. Its answers are backed by evidence uploaded to the portal and available in the same record. Sanctions screening and IBAN checks against fraud complete the picture.
What does an attacker see of your supplier?
A questionnaire tells you what the supplier declares; cyber exposure shows what an attacker sees. Bearlink observes each supplier from the outside, without access or questionnaires: exposed attack surface, risky configurations, leaks, domain spoofing. For a critical supplier, full monitoring goes through Beareye’s EASM module.
- Exposed attack surface
- Risky configurations
- Data leaks
- Domain spoofing
This cyber rating is produced natively by Beareye’s engines; the Bearlink page explains what sets it apart from an imported rating.
Decide together, and record waivers
A complete file does not decide for you. At onboarding or renewal, Procurement, the CISO and Legal make the call: accept, accept with conditions or reject. If a strategic supplier does not tick every box, a reasoned, dated waiver backed by an action plan is better than a silent exception.
Complete file
Procurement, CISO and Legal decide
- Accept
- Accept with conditions Reasoned, dated waiver backed by an action plan
- Reject
An action plan tracked through to resolution
When a gap appears, at onboarding or during the contract, such as a new leak or an exposed service, Bearlink raises an alert and proposes an action plan. Discussions with the supplier rest on precise findings rather than on a letter open to dispute. Each action is tracked through to resolution.
Manage your entire supplier portfolio
A supplier programme is only worth the share of files that are complete and up to date. Bearlink tracks that rate, flags incomplete files and expired documents, and gives each profile its own view: a Procurement report focused on compliance and contract, a Cyber report focused on the attack surface, a summary for senior management.
- Completeness rate
- Incomplete files and expired documents
- Reports by profile
Three situations where the workflow makes the difference
Three situations come up often: onboarding a critical supplier before signature, running the annual campaign to update supplier files, and reacting when the cyber exposure of a supplier under contract deteriorates. In all three, Procurement, the CISO and Legal share the same record and a recorded decision.
-
Onboard a critical supplier
Before signature, Procurement opens the record, the supplier uploads its documents and the CISO qualifies its exposure. Legal approves the clauses: the contract goes out with a complete file and a recorded decision.
-
Update the portfolio
During the annual campaign, reminders go out automatically and the dashboard shows incomplete or expired files. Each function sees what is still outstanding, supplier by supplier.
-
React to a cyber deterioration
During the contract, an alert flags a deterioration in a supplier’s exposure. The CISO opens an action plan, Procurement takes it up with the supplier and the resolution stays recorded in the record.
Sources and references
- Directive (EU) 2022/2555 (NIS2), Article 21, supply chain security, EUR-Lex
- Regulation (EU) 2022/2554 (DORA), Chapter V, ICT third-party risk, EUR-Lex
- Regulation (EU) 2016/679 (GDPR), Article 28, processors, EUR-Lex
- Law No. 2016-1691 of 9 December 2016 on transparency, the fight against corruption and the modernisation of economic life (Sapin II, French anti-corruption law), Légifrance (in French)
- Law No. 2017-399 of 27 March 2017 on the duty of vigilance of parent companies and ordering companies (French corporate duty of vigilance law), Légifrance (in French)
Sources consulted on . Report an error: contact+site@bearops.fr
Frequently asked questions
Who should lead supplier risk management: Procurement or the CISO?
No single function can carry it alone. Procurement manages onboarding, the contract and the relationship; the CISO provides the cyber assessment; Legal interprets the obligations and rules on waivers. The most effective approach is a shared workflow, where each function steps in at its stage on the same supplier record.
How do you match due diligence to a supplier’s criticality?
Start from criticality: what the supplier is used for, its access to your data or systems, how dependent your business is on it. A low-criticality supplier provides its mandatory documents; a critical supplier also answers the due diligence questionnaires and is subject to continuous cyber monitoring. Depth follows risk.
Do you need to ask the supplier for anything?
Not for cyber exposure: it is observed from the outside, without asking the supplier for anything. Compliance documents and questionnaire answers, on the other hand, are collected through the supplier portal. Both sit side by side in the same third-party record.
Does the cyber assessment replace document compliance?
No. They are two complementary parts of the same programme. Document compliance proves that the supplier meets its obligations; the cyber assessment reveals its real exposure. Bearlink brings both together in a single record, read by Procurement, the CISO and Legal.
Can Procurement use the cyber assessment without being experts?
Yes. Bearlink produces a readable Procurement report, focused on compliance and contract, and a more technical Cyber report for the CISO. Each profile reads the same data at its own level, with no cyber expertise required on the Procurement side, which makes the joint decision between functions easier.
What if a critical supplier does not tick every box?
Document a waiver rather than turning a blind eye. The decision is reasoned, dated, approved by the functions concerned and backed by an action plan with a deadline. The supplier remains under enhanced monitoring until the gaps are closed, and the record makes it easier to demonstrate compliance.
Run the workflow on one of your suppliers
Choose a critical supplier. A demonstration takes its file through Bearlink, from onboarding to decision: verified documents, tailored due diligence, cyber exposure and action plan, in a single record.