← Toolkit
TPL-121RegisterThird-party risk
Third-party register and concentration matrix
Three-tier segmentation and cross-referencing of shared dependencies.
The register segments by real criticality rather than by spend, and includes the matrix crossing suppliers against shared dependencies — hoster, subcontractor, certificate authority. A column filling across several rows signals a concentration invisible at tier 1.
How to use it
- Segment by criticality, never by spend
- Ask every critical supplier the tier-2 question
- Measure substitutability in lead time, not in the existence of alternatives
Courses that use it
Related templates
TPL-101
DORA register of information
Relational structure: entities, arrangements, providers, functions, sub-outsourcing.
TPL-105
ICT contract clause set
Common baseline and enhanced clauses for critical functions.
TPL-120
Supplier due diligence questionnaire
Fifteen questions calling for evidence, not statements.
TPL-122
Provider exit plan
Four verifiable elements, including a tested data extraction.