What is the Flexible Framework?
The Flexible Framework lets you choose exactly which controls a supplier needs to answer, based on the policies you've applied to them, rather than asking them to complete a fixed Small or Full framework.
It's most useful when:
A supplier needs a baseline set of controls plus a handful of extra ones, for example around data protection.
A supplier might be small and immature in their security practices - you just need to check that they have a handful of controls so you know they have the basics in place.
A supplier is still in procurement and hasn't been awarded a contract yet, so you only need enough information to gauge how critical they are.
A supplier's role in your business is narrow enough that some controls simply don't apply, for example a supplier providing physical goods only won't need to answer questions about software development practices.
For an overview of all three framework sizes (Small, Flexible and Full), see What are framework sizes?
How the controls are decided
Rather than a fixed set of questions, the Flexible Framework builds its control set from the policies applied to a supplier:
When you connect to a supplier (or update an existing connection), you apply policies based on the tags and labels you've assigned to that supplier.
Each policy maps to a set of controls. The combination of policies applied determines exactly which controls make up that supplier's Flexible Framework.
If you later update a supplier's tags or labels (for example, moving them from "Procurement" to "Fully onboarded"), the policies applied to them change, which updates the scope of their Flexible Framework automatically.
Applying the Flexible Framework to a supplier
You can set the Flexible Framework in the same way as any other framework size, either as part of the connection request flow or by editing an existing supplier's Framework Size.
See What are framework sizes? for the step-by-step screens.
When prompted to choose a Framework Size, select Policy-driven to apply the Flexible Framework.
If a supplier has already answered some of these controls
If a supplier has already provided answers to some of the required controls, through another connection or a previous framework, they'll only be asked for the controls they haven't yet completed.
In most cases, if they've already answered everything required, they won't need to provide anything further.
Moving a supplier to or from the Flexible Framework
You can move a supplier onto the Flexible Framework to reduce the number of questions they need to answer, or move them off it and onto the Full Framework if you need a more complete assessment.
This is particularly useful if a supplier is struggling to complete a fuller assessment: moving them to the Flexible Framework reduces the burden on them while still giving you the information you need.
Moving a supplier from the Flexible Framework to the Full Framework will:
Trigger an automated email notification to the supplier
Add a notification to their Activity Centre
FAQs
When does a supplier need to update their answers?
Whenever the policies applied to them change. This can happen indirectly, for example by moving a supplier from a "Procurement" label to "Fully onboarded", or directly, by updating a policy itself to require additional controls (for example, requiring personal data to be masked before use in AI).
Can I move a supplier to and from the Flexible Framework at any time?
Yes. You can move suppliers onto the Flexible Framework to reduce their question count, or back onto the Full Framework for a more complete assessment, at any point in the relationship.
Can I add my own custom questions to the Flexible Framework?
No. The Flexible Framework allows you to select the questions you want from our Standardised Assessment Framework, not customise the questions.
đĄ If there's anything we haven't covered, contact us at support@riskledger.com or use the Chat icon in the bottom right corner.