Compliance shows how well a supplier meets your security requirements. It tells you what percentage of your required security controls a supplier has implemented, calculated based on the policies you've applied to that specific supplier.

As suppliers signup to the platform and complete their security profiles, you can set up your policies within Risk Ledger and assign supplier tags to automatically calculate a compliance score.

The Suppliers Overview page gives you a quick snapshot of their overall compliance and highlights which domains are the most and least compliant.

Hovering over the question mark symbol (?) next to the Compliance Score will produce a popup where you can see which policies are applied to this supplier and their respective compliances:

You can also scroll down to policies in the right hand menu on the Overview page. Here you can see what policies have been applied to a supplier:

You can view which controls are compliant and non-compliant in detail by navigating to the "Assessment" tab.

You can filter for all compliant or non-compliant controls by selecting them in the "Filter by..." panel on the right hand side of the page.

To view further context for a control you can expand the control by clicking into it. From there you can see which policies require this control and can take action from there either by starting a discussion with your supplier, requesting remediation, or applying an exemption to the control (see below):

A supplier's compliance score is automatically calculated by looking at the applicable requirements in your policies and comparing them against a supplier's assessment to give you a percentage output as a score.

Only controls that are explicitly required by your policies are scored.

A control will only be included in the compliance calculation when:

Controls will be marked Not scored and excluded from the calculation when:

Not scored controls do not affect the overall compliance percentage.

This ensures suppliers are only scored on requirements that are both relevant and explicitly required by your organisation.

An exemption makes a non-compliant control compliant. It removes the requirement for that supplier to implement the control.

To apply an exemption:

You can remove the non-compliance at any time using the same steps.

For non-compliant controls you can also request remediation from the supplier.

When navigating to a supplier’s profile, there is an Overrides section on the Overview page where you can view any overrides that have been applied.

Overrides are when a client manually changes a compliance result and are broken down into:

You can click into either type to see which controls they apply to.

You can apply exemptions or non-compliance to multiple controls at once by selecting the controls using the tick-box to the left of a control and selecting "Apply to Selected" button on the top right corner of the assessment page.