Our third party risk management services help Australian organisations find the suppliers they depend on, measure the risk each one carries and act on it, with evidence a board, regulator or auditor can rely on. Security Solution Consultants (SSC) provides vendor risk assessment services and supplier security assessments, either as an outsourced function or alongside your procurement and risk teams, for APRA-regulated entities, critical infrastructure operators and organisations that supply into the European Union. The work runs on GRCLens, the GRC platform we build, so the vendor register, questionnaires, evidence and monitoring are still there after we hand over.
Outsourcing a service does not outsource accountability for it. Australian and European rules now spell out what a supplier program must contain, and several regulators expect to see the register itself.
| Regime | Applies to | What it expects of your supplier program |
|---|---|---|
| APRA CPS 230 Operational Risk Management | Banks, insurers, private health insurers and superannuation trustees | A board-approved service provider management policy, a register of material service providers submitted to APRA every year, due diligence before entering or materially changing a material arrangement, formal agreements and ongoing monitoring |
| APRA CPS 234 Information Security | The same entities | An assessment of the information security capability of any third party that manages your information assets, in proportion to the consequences of an incident |
| SOCI Act CIRMP | Responsible entities for critical infrastructure assets | Supply chain is one of four hazard domains. Under the enhanced rules, nine asset classes must map major suppliers and critical components and assess major supplier risk by about June 2028 |
| EU Digital Operational Resilience Act (DORA) | EU financial entities and, through their contracts, their ICT providers | Since 17 January 2025, a register of information covering every contractual arrangement for ICT services, mandatory contract terms and reporting to supervisors |
| EU NIS2 Directive, Article 21 | Essential and important entities in EU member states | Supply chain security, including the security of relationships with direct suppliers and service providers, as a minimum cyber risk management measure |
DORA and NIS2 bind EU entities, not Australian ones, but they reach Australian suppliers through the contract. If you sell software or managed services to an EU bank or insurer, expect register data requests, security questionnaires and audit clauses. The registers are not paperwork for its own sake: the European Supervisory Authorities used them to designate the first critical ICT third-party providers in November 2025. We help on both sides of that table.
CPS 230 commenced on 1 July 2025, and regulated entities submitted their first register of material service providers by 1 October 2025. A material service provider is one the entity relies on to undertake a critical operation, or one that exposes it to material operational risk. Providers of risk management, core technology services and internal audit must be classified as material unless the entity can justify otherwise, alongside industry-specific services such as claims management for insurers and fund administration for superannuation trustees.
Targeted amendments commenced on 1 July 2026. They exempt arrangements with certain categories of provider, such as regulators, central banks, exchanges and payment schemes, from specific contract requirements where the provider uses standardised terms, and APRA updated its register template for the 2026 submission. Three obligations catch entities out most often:
We identify material service providers from your critical operations rather than from the accounts payable ledger, build the register in APRA’s template and design the monitoring behind it. For the wider program, including critical operations, tolerance levels and CPS 234 control testing, see our APRA CPS 230 and CPS 234 advisory.
A questionnaire describes a supplier on the day it was answered. Between reviews we watch each vendor’s internet-facing estate with EASMLens, SSC’s external attack surface management platform: exposed services and databases, certificate and TLS hygiene, email security, dangling DNS and known breaches. The checks are agentless and non-destructive, so they need nothing installed by the vendor. Critical vendors are rescanned daily, high-risk vendors every three days and the rest weekly. A new high or critical finding, or a material fall in a vendor’s external score, raises an alert to the vendor’s owner.
An alert is a prompt for a person, not a verdict. Monitoring never changes a vendor’s risk rating by itself. Your analyst reviews the finding, raises it with the vendor and decides. A vendor that has never been scanned shows as not yet scanned, never as a score of zero, so the least-watched supplier cannot look like the safest.
The program runs in the GRCLens third party risk management module. It holds the vendor register with tiers and owners, the questionnaires and vendor portal, every piece of evidence and every review decision, the external posture history from EASMLens, and key risk indicators tied to named risks, such as the posture of your critical vendors. Because the platform stays with you, the program does not slide back into spreadsheets when the engagement ends.
Related services: APRA CPS 230 and CPS 234 advisory, SOCI Act compliance and CIRMP audit, enterprise risk management, penetration testing and ISO 27001 implementation.
Supplier inventory and tiering, risk-based vendor questionnaires with evidence review, deeper security assessments of critical providers, contract and exit reviews, continuous external monitoring and board reporting. We can run all of it as an outsourced function or support your own team.
A provider the entity relies on to undertake a critical operation, or one that exposes it to material operational risk. Providers of risk management, core technology services and internal audit must be treated as material unless the entity can justify otherwise.
Every year. The first registers were due by 1 October 2025, and APRA updated its register template for the 2026 submission after the targeted amendments that commenced on 1 July 2026.
Within 20 business days of entering into or materially changing an agreement for a service the entity relies on to undertake a critical operation, and before entering into a material offshoring arrangement.
No. External monitoring shows what an attacker can see between reviews, while questionnaires and evidence cover the controls that cannot be seen from outside. An alert prompts a review by a person and never changes a vendor's rating on its own.
DORA binds EU financial entities rather than their suppliers, unless a provider is designated as critical by the European Supervisory Authorities. In practice it reaches you through contract terms, security questionnaires and requests for register data, and we can help you answer them consistently.
Supply chain is one of the four CIRMP hazard domains. Under the enhanced rules, nine asset classes, including electricity, gas, water and freight, must map major suppliers and critical components and assess major supplier risks, including foreign ownership, control or influence, by about June 2028.
By tier. We tier each supplier by the critical operations it supports, the data it holds and the access it has, then match the depth of questionnaire, evidence and review frequency to that tier.
Tell us where you are today and what you need to achieve. We will come back with a clear scope, timeline and fixed quote.
Secure your cloud environments & ensure safe migration with compliance-ready.
Stay informed with the latest cybersecurity news and expert tips.
Copyright © 2026 Security Solution Consultants. ABN 87 616 212 063. Tarneit, Victoria 3029, Australia. All Rights Reserved.
