Run vendor assessments without chasing spreadsheets.
Send structured DORA questionnaires, let vendors respond in a self-service portal, track progress and review responses in one workspace.
ASM-2041 · AWS Annual ICT Assessment
Under Review117 questions · 12 sections · vendor submitted 4 August 2026
Section progress
- Governance & Oversight100%
- Information Security92%
- Business Continuity64%
- Incident Management88%
- Subcontracting45%
Q 4.3 · Business Continuity
Describe the frequency and scope of your disaster recovery testing.
“DR testing is performed periodically across production regions.”
AI Finding
Confidence 94%Disaster recovery testing evidence is missing.
The response describes testing but no test report was attached for the current period. Requires human review before any compliance decision.
Reviewed by Sarah Martin · AI suggestions never change compliance status automatically.
Capabilities
What you get
DORA questionnaire library
Templates for cloud, payment, SaaS and critical providers.
Vendor portal
Vendors answer without needing a full platform account.
Progress tracking
See completion by section, question and vendor.
Evidence requests
Ask for documents inside the questionnaire itself.
Review workspace
Compare responses across cycles and record decisions.
Gap detection
Potential gaps are surfaced for human review before sign-off.
Findings become tracked risks.
Accepted assessment findings convert into risks with an owner, severity, mitigation plan and due date.
- Create a risk from any finding
- Keep the link back to the source question
- Track remediation to completion
- Preserve the full decision history
Risk Register
7 high risks · 18 open · linked to assessments, evidence and contracts
| ID | Risk | Provider | Severity | Status | Owner |
|---|---|---|---|---|---|
| RSK-311 | DR testing evidence not provided | AWS | High | Mitigation Planned | S. Martin |
| RSK-318 | Exit strategy absent from contract | Microsoft | High | Open | T. Weber |
| RSK-324 | Subcontractor countries incomplete | Stripe | Medium | In Review | L. Dubois |
| RSK-327 | Pen test older than 12 months | Snowflake | Medium | Open | S. Martin |
| RSK-330 | No documented incident SLA | Temenos | Low | Accepted | M. Rossi |
Workflow
How the workflow runs
Get your ICT third-party risk under control.
See how one platform connects your ICT providers, assessments, evidence, contracts, risks and DORA Register.