Your suppliers' risk is your risk
You depend on dozens of vendors. Each one is a potential vector for a breach, a compliance finding, or a deal that stalls at security review. TractionGRC maps your supplier network across tiers, pulls each vendor's TractionScore™ into the view, and flags the ones worth actual attention.
Why supplier visibility matters
Supplier risk is where three different things come at you at once: enterprise deals, Stage 2 audits, and the breach that comes through a vendor you never thought about.
Deals stall at supplier review
Enterprise procurement teams do not just ask about your security. They ask about your suppliers' security. "Send us your vendor register with risk ratings" is a question you either answer in a day or chase for a month.
Auditors sample supplier work
ISO 27001 Annex A.5.19 to A.5.23 is one of the most frequently-sampled control families at Stage 2 audits. CMMC C3PAO assessors check the same surface under DFARS 252.204-7021 flowdown. Both want to see supplier register, contractual requirements, monitoring evidence, and termination procedures.
Tier 2 is where it hurts
Most breaches come through a supplier of a supplier. Your Tier 1 vendors may be mature. Their subcontractors often are not. The risk lives two hops away and most registers stop at one.
Acme Demo Co · Supplier Network Risk Map
Explore Acme's supplier network and understand how risk flows across tiers
One ID. Live data. No spreadsheets.
Every organization on TractionGRC gets a VendorConnect ID. Share it with customers and they add you to their supplier map with one click. Your TractionScore stays live on their view, with no questionnaire to re-fill and no spreadsheet to keep current.
- Unique ID assigned at registration
- Customers add suppliers with one click
- Live TractionScore syncs into the map
- Score drops of more than 10 points are flagged to customers
- Supports Tier 1, Tier 2, Tier 3 and beyond
Acme Demo Co · VendorConnect ID
tgrc-vc-3fa82c1d-9b47e605
Active
Share this ID with customers to appear on their supplier network map
New connection
Northwind Logistics added Acme as a Tier 1 supplier. Acme's score (76) is now visible on their supplier network view.
2 minutes ago
Where supplier oversight comes from
Supplier risk management is not optional. Four different sources demand it, in four different shapes.
Supplier relationships require documented security policies, contractual requirements, supply chain information security, and monitoring of supplier service delivery throughout the relationship lifecycle.
Trust Services Criteria require controls over vendor selection, due diligence, ongoing monitoring, and incident response procedures for third-party providers.
DoD prime contractors must flow CMMC requirements down to subcontractors handling the same CUI. A prime at Level 2 needs every CUI-touching sub at Level 2 for that scope. C3PAO assessors check this directly.
Customer-driven questionnaire programs like Microsoft SSPA require direct supplier oversight of subcontractors. TractionGRC includes starter libraries for SSPA (DPR v12), SIG, SIG Lite, CAIQ, and HITRUST.
Run the assurance programs your customers ask for
Customers send you SSPA, SIG, CAIQ, or HITRUST. You send your own vendors the same, or something similar. TractionGRC runs both directions of the workflow from one place, so the work you do answering a questionnaire becomes the evidence you use to issue one.
Respond to assurance requests
When a customer issues a program to you through TractionGRC, answer it on any plan, including Free. When a questionnaire arrives from outside TractionGRC, such as Microsoft's annual SSPA, set it up from a starter library and prepare your responses and evidence here. Starter includes one active external questionnaire. Professional and Enterprise are unlimited.
- Answer programs customers issue to you on TractionGRC, on every plan
- Prepare SSPA, SIG, SIG Lite, CAIQ, or HITRUST responses from Starter
- Reuse evidence and draft responses with TractionAI based on your own controls
- Share completed responses through a link or export them as a PDF package
Issue assurance programs from the catalog
Run your own supplier assurance programs at scale. Pick from our starter libraries, assign suppliers, collect evidence, and track readiness across your vendor ecosystem.
- 5 starter libraries: SSPA, SIG, SIG Lite, CAIQ, HITRUST
- Custom programs for your own standard on Enterprise
- Assign programs to suppliers in your network
- Track supplier responses and evidence in one view
Starter libraries in the catalog
Prepare your own responses from any of these on Starter (one active questionnaire) or Professional and Enterprise (unlimited). Issuing them to your suppliers requires Professional.
SSPA
★DPR v12 · March 2026
Microsoft Supplier Security & Privacy Assurance. All 63 DPR v12 requirements, sections A to K, numbered to match the DPR.
SIG
2025
Shared Assessments full SIG. Extended supplier assurance for higher-risk or strategic vendors.
SIG Lite
2025
Condensed SIG questionnaire. Suitable for lower-risk vendor reviews.
CAIQ
v4.0
Cloud Security Alliance Consensus Assessments Initiative. Cloud-focused assurance.
HITRUST
i1
HITRUST Implemented (1-year) starter library. Healthcare and regulated assurance.
Starter libraries are editable starting points. You can add, remove, or customize requirements to match your own program. CMMC L2 readiness across your subcontractor base is tracked through the framework toggle on each supplier rather than a separate questionnaire library.
How it works
Map your suppliers
Add Tier 1 suppliers by VendorConnect ID for live data, or manually for vendors not yet on TractionGRC.
Connect their environment
Suppliers can connect Azure, AWS, or Google Workspace so signal visibility updates automatically instead of relying on manual reporting.
Watch risk flow across tiers
TractionScore updates at each node, helping you see where weaker suppliers may create downstream exposure. CMMC contractors can see at a glance which subs hold valid Level 2 certification for the same scope.
Keep the record auditors ask for
Your supplier register, each supplier's TractionScore and frameworks, and the risk events from score drops stay in one place. That's the record auditors sample for ISO 27001 A.5.19 to A.5.23 and C3PAO assessors check for CMMC DFARS flowdown. A daily sync flags any connected supplier whose score drops by more than 10 points.
Supplier limits by plan
- Tier 1, 2 and 3 mapping
- Manual and connected suppliers
- Live TractionScore sync
- Answer programs customers issue to you
- Tier 1, 2 and 3 mapping
- Manual and connected suppliers
- Live TractionScore sync
- One active external questionnaire, such as SSPA
- All Starter features
- Unlimited external questionnaires
- Issue assurance programs from catalog
- All Professional features
- Custom assurance programs
Start with the suppliers that matter most
Free maps up to 3 suppliers and Starter up to 10. Professional expands to 50 and unlocks issuing your own assurance programs. Enterprise removes the cap.