Excel in the TPRM (Third-Party Risk Management - managing the risks associated with suppliers and external partners) works. Although some probably do not run it, because there is no such process in the company (yet). At many in particular, when the number of contracts is dozens, hundreds or more there is probably already an entire department that deals with it. Risks generated by suppliers are managed best in regulated companies and institutions, e.g. finance.
NIS2 does not require: „you will implement a TPRM tool”, it only makes it mandatory to implement a cyber risk management measures, and one of the key elements is Supply chain security and supplier relationships, subcontractors, integrators and components that you don't see because they are hidden in another organization's CMS. The WEF GCO report (Global Cybersecurity Outlook 2026) this year put it simply: dependencies in the digital supply chain are often unmapped, and a breach at one supplier can cascade through the entire ecosystem.
Excel loses undoubtedly to reality, because this reality is changing very quickly, new players are coming in, new risks.
The sheet and the survey have three drawbacks that you can't jump over:
- are based on declarations, not measurement,
- Are spotty (once a year/quarter),
- do not catch changes between reviews.
What does the „ratings + continuous monitoring” approach provide?
This is where observation-based rating platforms come in. From what I can see there are several such platforms. I operate with RiskRecon by Mastercard. The logic behind it is key: the tool constantly monitors, and then arranges the results so that they can be managed, not just watched. What I like most is the rating and the ability to act if the observed supplier has a low rating. This system should not be confused with vulnerability detection systems, or GRC systems. They are a different group of systems, although different platforms may combine these functions.
GRC answers the question: „How do we manage risk and compliance across the company?”
TPRM answers the question: „How do we control the risks that our suppliers and partners bring?”
How can the different TPRM systems be compared?
- RiskRecon by Mastercard weighs the problems not only „how serious,” but also states where in what component the problems occur and what it is value of this component/system (e.g., whether it collects sensitive data or enables transactions). Prioritization „under risk,” not just „under number of findings.”.
- SecurityScorecard Describes scoring as factorial-based and calculation-based number and significance detected problems (severity + quantity).
- BitSight emphasizes that the rating is created from external data from two classes: configurations i security incidents, calculated daily.
Detecting and identifying vulnerabilities is very important, but combining it with the value of the system and comparing it with other similar entities gives additional value. It is also important to me to get such a report on an ongoing basis. This is a general advantage over collecting Excels or other forms of static periodic reporting.
How would I organize it in practice?
I would leave Excel for collecting supplier declarations. And I would move the assessment of real supplier risk to a continuous model:
- rating and monitoring as „radar” (which is changing),
- priorities under context (which really hurts),
- action plan to the supplier (what to improve and when).
The WEF calls the problem by its name: the supply chain is too interconnected, too lacking in visibility and too easily doing a domino effect.
After stories where the problem started at the supplier (e.g., support companies, external troubleshooting), it's hard to pretend that a survey once a year is enough. Also take a peek at this risk topic, it's not just AI that's changing the world.
Consultation with an ISCG expert: https://outlook.office.com/book/MeetingswithISCGExperts@ISCG.onmicrosoft.com/s/4OIyaXg2FECLomR4u85ATw2?ismsaljsauthenabled