As suppliers signup to the platform and complete their security profiles, you can setup your policies within Risk Ledger and assign supplier tags to automatically calculate a compliance score.

Compliance is a measure of how many of the security controls that a supplier has implemented align with the requirements that you have applied over that supplier, within your applicable policies.

💡To calculate a suppliers compliance you must have tags applied to that supplier. If there are no tags applied the compliance score will automatically sit at 100% as there will be no policies applied over their assessment. If this is the case the platform will display a warning message on the supplier overview page under the "Policies Applied" card on the right hand side of the page.

A suppliers compliance score is automatically calculated by looking at the applicable requirements in your policies and comparing them against a suppliers assessment to give you a percentage output as a score.

The Suppliers Overview page gives you a quick snapshot of their overall compliance and highlights which domains are the most and least compliant.

You can view which controls are compliant and which non-compliant in detail by navigating to the "Assessment" tab.

You can filter for all compliant or non-compliant controls by selecting them in the "Filter by..." panel on the right hand side of the page.

To view further context for a control you can expand the control by clicking into it. From there you can see what your policy requires and can take action from there either by starting a discussion with your supplier, requesting remediation, or applying an exemption to the control (see below).

💡If a supplier marks a control as N/A but your policy requires that control to be in place the platform will still mark that control as non-compliant. This is so that you do not miss any potential security gaps. To accept the N/A response as a compliant, you can apply an exemption to the control.

An exemption makes a non-complaint control compliant. An exemption is a way for you to remove the requirement for a supplier to have a control implemented. You may want to do this if a supplier falls under a requirement that, upon examination, you don't think is relevant to them.

To apply an exemption, please follow the steps below;

For non-compliant controls you can request that a supplier remediate the control.

When navigating to a supplier’s profile, there is an Overrides section on the Overview page, which allows you to view any Overrides that have been applied to their assessment.

Overrides are when a client chooses to override a compliance calculation, and are broken down into:

You can manually click into either of these Override types, which will take you to the specific controls they are applied against.

You can apply exemptions or non-compliance to multiple controls at once by selecting the controls using the tick-box to the left of a control and selecting "Apply to Selected" button on the top right corner of the assessment page.