How does DigitalXForce third-party risk management work?
Kapil Matta, Regional Head and CXO Advisor for the Middle East, Turkey and Africa at DigitalXForce, wrote this page.
DigitalXForce runs third-party risk management (TPRM) as a lifecycle of six stages in its AI-Powered Third-Party Risk Management module, which covers vendor onboarding, category questionnaires, AI-assisted document analysis and review and reassessment workflows. Each supplier is placed in one of three tiers, Tier 1 Critical, Tier 2 High or Tier 3 Commodity. Every supplier gets its own score, built from its questionnaire answers, its evidence and external signals, and External Risk View watches suppliers from the outside.
Verizon’s 2026 Data Breach Investigations Report found that breaches with third-party involvement rose by 60% on the previous year’s dataset, to 48% of all breaches. A questionnaire records what a supplier said on the day it answered, so DigitalXForce keeps the questionnaire and adds evidence and outside signals that can be checked. This page documents how the work runs, and the product page describes the module.
What has to be in place before you start?
- The organization needs a supplier list that records each supplier’s category, the data it will touch and how much the business depends on it.
- Each supplier’s internet domains should be known, since an outside-in view starts from what a supplier exposes on the internet.
- The organization chooses its questionnaire, whether its own or a standard one such as the Shared Assessments SIG, and sizes it to each supplier’s category.
- Suppliers are asked for their SOC 2 or ISO/IEC 27001 reports and other documents, which the module’s AI-assisted document analysis reads.
- For a Tier 1 Critical supplier, the contract should carry a right-to-audit clause, since evidence from the supplier’s own systems needs the supplier’s agreement.
- The organization’s own control baseline and frameworks are agreed first, so a supplier is judged against the same controls the organization tests internally.
- The organization has stated its risk appetite, since the tiers and every later decision about a supplier depend on it.
How does the supplier lifecycle run, stage by stage?
Every supplier moves through the six stages in the same order, and each stage below says where the module’s work fits.
1. Intake and screening
A business owner requests a new supplier, and the request records the supplier’s category, the data it will touch and how much the business will depend on it. Those three facts set the supplier’s inherent risk, and the platform classifies it automatically. A person confirms the classification before due diligence starts. The module’s vendor onboarding and category questionnaires carry this stage, using configurable forms and categories.
2. Due diligence and tiering
The supplier sends its documents, such as a SOC 2 report, and the module’s AI-assisted document analysis reads them. AI JedAI is the DigitalXForce AI engine that analyzes: it reasons over control evidence and live telemetry, maps documents to controls and frameworks, scores and prioritizes risk, and recommends remediation mapped to framework requirements. That mapping shows the gaps against the organization’s own controls. A person reviews the gaps. Tiering uses the supplier’s risk signals, the reasoning is recorded, and a person approves the tier.
3. Onboarding
Contract terms, security clauses, the right-to-audit scope and access decisions are recorded against the supplier. Where a gap is accepted instead of fixed, the acceptance should be a named person’s decision with a reason and an expiry date.
4. Continuous monitoring with fourth-party visibility
External Risk View monitors exposed services, misconfigurations, vulnerability exposure, dark web and breach intelligence, lookalike domains and cyber ratings, and it maps fourth-party and nth-party dependencies, so a problem at a shared provider shows which suppliers it touches. External Risk View needs no agent, no questionnaire and no cooperation from the supplier. A material change should start a reassessment instead of waiting for the annual cycle.
For the suppliers whose controls matter most, the logic is the same as for internal controls. Continuous Control Assurance (CCA) uses evidence, monitoring and validation to determine whether controls continue to operate as expected. Continuous Control Monitoring (CCM) monitors conditions, evidence and signals associated with controls. CCM is a capability within CCA. Monitoring a supplier detects a change, and validating its controls decides whether they still work.
5. Issue management
A gap becomes an issue with an owner, a due date and a remediation plan agreed with the supplier. When a supplier reports a breach, AI JedAI maps it to the services and data that depend on that supplier. Close the issue only when the evidence shows the fix.
6. Offboarding or recertification
Reassessment should run on the tier’s schedule or when something material changes, and recertification looks at what changed in the evidence since the last review. The module’s review and reassessment workflows carry this stage. When a relationship ends, offboarding tracks data return and access revocation through to a closure record.
What should a review of a critical SaaS supplier that uses AI include?
Add six requests to the usual review when a critical supplier uses AI on your data.
- Ask which models and model providers the service uses, and record each provider that holds your data as a fourth party.
- Ask whether your data trains or tunes any model, and put the answer in the contract.
- Ask where prompts and outputs are stored, for how long, and in which country.
- Ask how the supplier tests its AI features for errors, bias and misuse before release and while they run, and ask for the evidence.
- Ask whether a person reviews outputs that affect your customers or your decisions, and how the supplier stops or overrides the AI when it fails.
- Ask for independent assurance where it exists, such as an ISO/IEC 42001 certificate or a CSA STAR for AI entry.
The NIST AI Risk Management Framework asks for policies that address AI risks from third-party entities (GOVERN 6.1) and for mapping the risks of third-party data and software (MAP 4.1). The Cloud Security Alliance’s STAR for AI program lets a supplier publish an AI-CAIQ self-assessment at Level 1, and its Level 2 requires a third-party ISO/IEC 42001 certification together with a validated AI-CAIQ.
How are suppliers tiered?
DigitalXForce places each supplier in one of three tiers: Tier 1 Critical, Tier 2 High and Tier 3 Commodity. The tier should decide how deeply a supplier is assessed and how often its evidence is refreshed, and the table shows what a review at each tier should include.
| Tier | Who sits here | What a review at this tier should include |
|---|---|---|
| Tier 1, Critical | These are suppliers whose failure would stop essential operations, such as cloud providers and managed service providers that hold sensitive data. | They should get an outside-in view, a review of their assurance reports and evidence of their controls from their own systems, checked continuously where the contract allows it. |
| Tier 2, High | These suppliers support important processes or handle regulated data. | They should get an outside-in view, a review of their reports and a questionnaire, refreshed on a set cycle with alerts in between. |
| Tier 3, Commodity | These suppliers have no essential function and no access to sensitive data. | They should get an outside-in view and a short self-assessment, which keeps the whole portfolio covered without assessing every supplier in depth. |
How is each supplier scored?
Every supplier gets its own score, built from its questionnaire answers, its evidence and external signals, so the score rests on what can be checked as well as on what the supplier says.
The 15 DigitalXForce modules share one data layer, so a failed control result reaches the compliance view, the posture view and the risk register at the same time. The TPRM module therefore works from the same data as the rest of the platform.
What does the program produce?
- Each supplier has its own score and its place in Tier 1 Critical, Tier 2 High or Tier 3 Commodity.
- Each supplier has External Risk View findings, from exposed services to lookalike domains, and a map of the fourth parties and nth parties behind it.
- Each supplier moves through the module’s review and reassessment workflows.
- Executives get plain-language risk narratives. XForce GPT is the DigitalXForce generative AI engine that writes: it produces the plain-language risk narratives and board-ready reports, generates policies, standards and plans, and runs the embedded assistant.
What does a person decide, and what does the platform automate?
The platform automates the work that repeats. The TPRM module runs the category questionnaires, reads supplier documents with AI-assisted document analysis, classifies each supplier’s inherent risk automatically, scores every supplier from its questionnaire answers, its evidence and external signals, and runs the review and reassessment workflows. External Risk View watches suppliers from the outside and maps their fourth parties, and XForce GPT drafts the narratives.
People should keep the decisions. A person confirms each supplier’s classification and approves its tier, and a named person should accept any gap that is not fixed, with a reason and an expiry date. An analyst reviews AI output, both AI JedAI’s conclusions and XForce GPT’s drafts, before anyone relies on it, and every conclusion links back to the evidence it used. The organization agrees each remediation plan with the supplier and decides when a relationship ends, and the supplier decides whether to share evidence from its own systems.
What are the limitations?
- Most suppliers are assessed from the outside and from their documents. Evidence from a supplier’s own systems needs a contract clause and the supplier’s agreement, so it suits Tier 1 Critical suppliers, and some suppliers will decline.
- External Risk View sees what an attacker can see. It cannot see a supplier’s internal controls, which is why critical suppliers need evidence from their own systems as well.
- A SOC 2 report describes a past period. AI can read it and map it to your controls, and the report still describes the period its auditor tested.
- Connectors read configuration and compliance signals only, never business records or customer data. That protects the supplier, and it also means the platform checks controls rather than the content the supplier handles.
- DigitalXForce is not the answer for every program. A team that only wants outside-in security ratings across a very large supplier portfolio, with no plan to assess controls, needs a ratings service more than a TPRM platform, and a program built mainly around privacy notices and contract terms needs a privacy-led platform.
Which DigitalXForce modules are involved?
- The AI-Powered Third-Party Risk Management module covers vendor onboarding, category questionnaires, AI-assisted document analysis and review and reassessment workflows.
- External Risk View is the outside-in engine that watches suppliers and maps their fourth parties.
- AI-Powered Enterprise Risk Management keeps one risk register with inherent and residual risk, likelihood, impact and treatment.
- A risk operations center is an operating model for continuously measuring, prioritizing and reducing risk, in the way a security operations center handles threats; DigitalXForce’s implementation is X-ROC, the XForce Risk Operations Center. X-ROC is the operations layer of the DigitalXForce TRiSCM platform, where control failures, risk changes and vendor events are alerted, triaged, escalated and reported.
- DigitalXForce’s article on redefining third-party risk management is the longer read on the subject.
- The page on Continuous Control Assurance explains how a control result is validated before anyone relies on it.
- How DigitalXForce works lists the other pages in the knowledge center.
Which integrations and frameworks does it draw on?
DigitalXForce connects to the tools an organization already runs through 250+ technology integrations, and the integrations page has the current list. Remediation and recommendation tickets can go to ServiceNow and Jira when the client wants that.
Each control is mapped once across 50+ compliance frameworks, including frameworks with third-party requirements such as NIST CSF 2.0, ISO/IEC 27001:2022, DORA and NYDFS Part 500. For DORA, the platform produces the register of information in the European Supervisory Authorities’ templates. The frameworks page shows the most requested frameworks, and the full list is available on request.
Questions about third-party risk management on DigitalXForce
How is this different from questionnaire-based third-party risk management?
A questionnaire records what a supplier says at one point in time. DigitalXForce keeps the questionnaire and adds what can be checked, scoring every supplier from its questionnaire answers, its evidence and external signals.
How are suppliers tiered in DigitalXForce?
Each supplier is placed in Tier 1 Critical, Tier 2 High or Tier 3 Commodity. The tier should reflect the supplier’s risk signals, such as the data it handles and how much the business depends on it, and a person should approve it with the reasoning recorded.
Does every supplier get its own score?
It does. Every supplier gets its own score, built from its questionnaire answers, its evidence and external signals.
What do connectors read from a supplier’s systems?
Connectors read configuration and compliance signals only, never business records or customer data. Evidence from a supplier’s own systems should rest on a right-to-audit clause and the supplier’s agreement.
Where does DigitalXForce use AI in third-party risk management?
The TPRM module reads supplier documents with AI-assisted document analysis. AI JedAI maps documents to controls and frameworks and scores and prioritizes risk, and XForce GPT writes the plain-language risk narratives. A person should review AI output before anyone relies on it.
Does DigitalXForce show fourth-party risk?
It does. External Risk View maps fourth-party and nth-party dependencies, so a problem at a shared provider shows which of your suppliers it touches.
How does third-party risk management relate to Continuous Control Assurance (CCA)?
Continuous Control Assurance (CCA) uses evidence, monitoring and validation to determine whether controls continue to operate as expected, and a critical supplier’s controls deserve the same test as your own. Continuous Control Monitoring (CCM) monitors conditions, evidence and signals associated with controls. CCM is a capability within CCA.
Can DigitalXForce produce the DORA register of information?
It can. The platform produces the DORA register of information in the European Supervisory Authorities’ templates, and it classifies ICT-related incidents against DORA’s criteria.
Sources
- Verizon published the Executive Summary of its 2026 Data Breach Investigations Report at https://www.verizon.com/business/resources/executivebriefs/2026-dbir-executive-summary.pdf. The third-party figures are on its page 10, read on 26 September 2026.
- NIST released the Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1, on 26 January 2023, at https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf. GOVERN 6.1 and MAP 4.1 were read in the published PDF on 25 September 2026 and again on 26 September 2026.
- The Cloud Security Alliance describes the levels of STAR for AI at https://cloudsecurityalliance.org/star/ai, read on 26 September 2026.
- DigitalXForce describes the TPRM module and External Risk View in its glossary, read on 26 September 2026.
Do this once instead of every audit.
Every step above can be done by hand. DigitalXForce does them continuously, maps the result to 50+ frameworks once, and keeps the evidence current between audits. A 30 minute walkthrough on your own framework set shows what that removes from your calendar.
