Your suppliers' risk is your risk
You depend on dozens of vendors. Each one is a potential vector for a breach, a compliance finding, or a deal that stalls at security review. TractionGRC maps your supplier network across tiers, pulls each vendor's TractionScore™ into the view, and flags the ones worth actual attention.
Why supplier visibility matters
Supplier risk is where three different things come at you at once: enterprise deals, Stage 2 audits, and the breach that comes through a vendor you never thought about.
Deals stall at supplier review
Enterprise procurement teams do not just ask about your security. They ask about your suppliers' security. "Send us your vendor register with risk ratings" is a question you either answer in a day or chase for a month.
Auditors sample supplier work
ISO 27001 Annex A.5.19 to A.5.23 is one of the most frequently-sampled control families at Stage 2 audits. CMMC C3PAO assessors check the same surface under DFARS 252.204-7021 flowdown. Both want to see supplier register, contractual requirements, monitoring evidence, and termination procedures.
Tier 2 is where it hurts
Most breaches come through a supplier of a supplier. Your Tier 1 vendors may be mature. Their subcontractors often are not. The risk lives two hops away and most registers stop at one.
Acme Demo Co · Supplier Network Risk Map
Explore Acme's supplier network and understand how risk flows across tiers
One ID. Live data. No spreadsheets.
Every organization on TractionGRC gets a VendorConnect ID. Share it with customers and they add you to their supplier map with one click. Your TractionScore stays live on their view, with no questionnaire to re-fill and no spreadsheet to keep current.
- Unique ID assigned at registration
- Customers add suppliers with one click
- Live TractionScore syncs into the map
- Score changes can trigger upstream review
- Supports Tier 1, Tier 2, Tier 3 and beyond
Acme Demo Co · VendorConnect ID
TG-AC3E-DEM0
Active
Share this ID with customers to appear on their supplier network map
New connection
Northwind Logistics added Acme as a Tier 1 supplier. Acme's score (76) is now visible on their supplier network view.
2 minutes ago
Where supplier oversight comes from
Supplier risk management is not optional. Four different sources demand it, in four different shapes.
Supplier relationships require documented security policies, contractual requirements, supply chain information security, and monitoring of supplier service delivery throughout the relationship lifecycle.
Trust Services Criteria require controls over vendor selection, due diligence, ongoing monitoring, and incident response procedures for third-party providers.
DoD prime contractors must flow CMMC requirements down to subcontractors handling the same CUI. A prime at Level 2 needs every CUI-touching sub at Level 2 for that scope. C3PAO assessors check this directly.
Customer-driven questionnaire programs like Microsoft SSPA require direct supplier oversight of subcontractors. TractionGRC includes starter libraries for SSPA (DPR v12), SIG, SIG Lite, CAIQ, and HITRUST.
Run the assurance programs your customers ask for
Customers send you SSPA, SIG, CAIQ, or HITRUST. You send your own vendors the same, or something similar. TractionGRC runs both directions of the workflow from one place, so the work you do answering a questionnaire becomes the evidence you use to issue one.
Respond to assurance requests
When a customer sends you an SSPA, SIG, SIG Lite, CAIQ, or HITRUST questionnaire, respond directly in TractionGRC. Pull evidence from your controls library, reuse previous responses, and let TractionAI draft answers you can review.
- Answer questionnaires from customers through a shareable link
- Reuse evidence across multiple requests
- Draft responses with TractionAI based on your own controls
- Export completed responses as a PDF package
Issue assurance programs from the catalog
Run your own supplier assurance programs at scale. Pick from our starter libraries, assign suppliers, collect evidence, and track readiness across your vendor ecosystem.
- 5 starter libraries: SSPA, SIG, SIG Lite, CAIQ, HITRUST
- Build custom programs for your own requirements
- Assign programs to suppliers in your network
- Track supplier responses and evidence in one view
Starter libraries in the catalog
Available to issue on Professional and Enterprise plans. Respond to any of these on every plan.
SSPA
★DPR v12 · April 2026
Microsoft Supplier Security & Privacy Assurance. Core starter library for Microsoft suppliers.
SIG
2025
Shared Assessments full SIG. Extended supplier assurance for higher-risk or strategic vendors.
SIG Lite
2025
Condensed SIG questionnaire. Suitable for lower-risk vendor reviews.
CAIQ
v4.0
Cloud Security Alliance Consensus Assessments Initiative. Cloud-focused assurance.
HITRUST
i1
HITRUST Implemented (1-year) starter library. Healthcare and regulated assurance.
Starter libraries are editable starting points. You can add, remove, or customize requirements to match your own program. CMMC L2 readiness across your subcontractor base is tracked through the framework toggle on each supplier rather than a separate questionnaire library.
How it works
Map your suppliers
Add Tier 1 suppliers by VendorConnect ID for live data, or manually for vendors not yet on TractionGRC.
Connect their environment
Suppliers can connect Azure, AWS, or Google Workspace so signal visibility updates automatically instead of relying on manual reporting.
Watch risk flow across tiers
TractionScore updates at each node, helping you see where weaker suppliers may create downstream exposure. CMMC contractors can see at a glance which subs hold valid Level 2 certification for the same scope.
Export evidence or trigger review
One click exports the supplier register, monitoring log, and review records auditors sample for ISO 27001 A.5.19-A.5.23 and that C3PAO assessors check for CMMC DFARS flowdown evidence. Score drops on a critical supplier trigger a review task, not just a dashboard alert.
Supplier limits by plan
- Tier 1 mapping
- Manual and connected suppliers
- Live TractionScore sync
- Respond to assurance requests
- All Starter features
- Multi-tier mapping
- Risk signal propagation
- Issue assurance programs from catalog
- ISO and CMMC supplier controls evidence export
- All Professional features
- Multi-entity scopes
- Custom assurance programs
- API access for supplier data
- Unlimited tiers
Start with the 5 suppliers that matter most
Starter includes supplier mapping for your five highest-risk vendors. Professional expands to 25 and unlocks issuing your own assurance programs. Enterprise removes the cap.