# Supplier Register
URL: https://docs.autociso.io/console/directory/suppliers/
Description: The Supplier Register is the governance workspace for third-party organizations your company depends on.

*This is the help text the console shows in the help panel on this page.*

The Supplier Register is the governance workspace for third-party organizations your company depends on. Use it to maintain an auditable supplier inventory, assign accountable owners, and track review cadence for vendor assurance.

### Why This Page Matters
Supplier records support core third-party governance requirements in:
- **ISO 27001 A.5.19** (supplier relationships)
- **ISO 27001 A.5.20** (supplier agreements)
- **ISO 27001 A.5.21 / A.5.22** (ICT supply chain monitoring and review)
- **SOC 2 CC9.2** (vendor and third-party risk management)

### Adding Suppliers
- **Add Supplier** — opens the supplier drawer to fill in the details by hand.
- **Add Single** (AI) — launches the Supplier Wizard to pre-fill the form.
- **Import List** — upload a CSV file (up to 5 MB) from a procurement system or vendor directory. AI maps your columns automatically; rows are matched by legal name (a **legalName** column is required), existing suppliers get their empty fields filled in, and new ones are created.
- **Questionnaires** — opens the [list of supplier questionnaires](https://docs.autociso.io/console/directory/supplier-questionnaires/) you [send with assessments](https://docs.autociso.io/product/suppliers/assessments/).

### Preset Filters
Use the filter cards to triage the register quickly:
- **All** — full supplier inventory
- **Active** — currently in-service suppliers
- **Onboarding** — suppliers still in onboarding state
- **Overdue Review** — suppliers whose **Next Assessment Due** date is in the past
- **Critical** — suppliers with Critical criticality

Below the cards, use the search box and the **Tags**, **Category**, **Criticality**, **Status**, **Privileged Access**, **Framework**, **Supplier Owner** and **Crown Jewel** filters to narrow the table; **Clear filters** resets them. **CSV** and **PDF** download the current view, and the refresh button reloads it.

### Main Table & Actions
Each row gives a compact risk snapshot: category, criticality, lifecycle status, next review date, and assessment state. Click a row to open the supplier drawer. The row menu offers **Edit**, **Clone**, **Export Dossier** (a PDF summary of the supplier) and **Delete** (role-based).

### Drawer Structure
Supplier details are organized into sections on the left of the drawer:
- **Identity** — legal and operating identity, contact person, and the three owners (supplier, business, security)
- **Risk Profile** — criticality, dependency type, network access, privileged access, crown-jewel support, and data exposure (PII, PHI, card data)
- **Privacy** — data locations, [sub-processors](https://docs.autociso.io/console/privacy/data-processors/), DPA status, breach notice SLA and deletion assistance
- **Assurance & Certification** — assessment cadence and framework attestations
- **Reviews / Agreements / Assessments** — available after the supplier is created

### Reviews Table
The **Reviews** tab tracks recurring or event-triggered supplier assessments. Rows are loaded with newest due dates first and include:
- review type (**Initial**, **Periodic**, **Incident Triggered**, **Renewal**)
- due date and completion date
- outcome (**Pass**, **Conditional**, **Fail**) with severity tags
- reviewer and notes

Click a row to edit it. Use the trash icon to remove a review record.

### Review Form
Click **Add Review** to open the review form. Use it to record:
- review type
- due date and completed date
- outcome (enabled only after a completed date is set)
- optional risk delta (numeric)
- reviewer and notes

Saving creates or updates a review entry and refreshes the table.

### Agreements Table
The **Agreements** tab tracks contractual security terms. Rows are loaded by contract end date and include:
- agreement title
- contract period (start-end)
- automatic status tags: **Expired** or **Expiring soon** (within 90 days)
- DPA signed, security addendum signed, and right-to-audit flags (check/cross)
- breach notice window in hours

Click a row to edit it. Use the trash icon to remove an agreement.

### Agreement Form
Click **Add Agreement** to open the agreement form. Use it to maintain:
- title (required)
- contract start and contract end dates
- DPA signed toggle
- security addendum signed toggle
- right-to-audit toggle
- breach notice SLA in hours
- termination requirements notes
- evidence documents (PDF, DOCX, or image, up to 10 MB each) attached with **Upload Document**

This form keeps contract metadata audit-ready and supports renewal and legal/security review workflows.

### Operating Guidance
Start with critical suppliers and assign all three ownership roles (supplier, business, security). Records without owner assignment or review cadence become governance blind spots during audits and renewal decisions.

### Automatic Expiry Notifications
The system runs a background check every 6 hours scanning for supplier reviews and agreements approaching their expiry dates. It creates notifications automatically based on the following rules:

**Supplier Reviews** — notifications are created for incomplete reviews (no completed date) whose due date is within the next 45 days:
- **Info** — more than 30 days remaining
- **Warning** — 30 days or fewer remaining
- **Critical** — 7 days or fewer remaining, or already overdue

**Supplier Agreements** — notifications are created for agreements whose contract end date is within the next 45 days:
- **Info** — more than 30 days remaining
- **Warning** — 30 days or fewer remaining
- **Critical** — 7 days or fewer remaining, or already expired

Notifications are deduplicated: one notification per review or agreement, updated on each scan. They auto-expire 30 days after the due/end date. All notifications appear in the [notification bell](https://docs.autociso.io/console/overview/notifications/) in the top bar.

## Fields

### Legal Name

The supplier's registered legal entity name used in contracts and legal documentation.

Use the exact contract name to avoid ambiguity during audits and agreement reviews.

### Display Name

The operational name shown in tables and reports. If omitted, the UI falls back to the legal name.

Use a short recognizable label (for example, product or brand name) for faster triage.

### Supplier Status

Lifecycle stage of the supplier relationship:
- **Onboarding** — intake and initial due diligence
- **Active** — supplier in production use
- **Offboarding** — planned exit in progress
- **Terminated** — relationship ended

### Service Category

Classifies what service the supplier provides (for example SaaS, Infrastructure, Managed Service, Legal, Payroll, Security).

Category improves reporting and helps segment review cadence by risk domain.

### Website

Primary supplier URL (typically homepage or admin portal).

Store a canonical URL to support discovery, documentation, and future evidence workflows.

### Supplier Owner

Primary accountable owner for the supplier relationship and day-to-day coordination.

This role should be able to answer operational dependency questions quickly.

### Business Owner

Business-side owner responsible for the commercial use case and renewal decisions.

This owner validates whether the supplier still delivers required business value.

### Security Owner

Security owner responsible for assurance, control reviews, and exception handling.

This role should track assessment outcomes and escalation for failed or conditional reviews.

### Criticality

Business impact if the supplier fails or is compromised:
- **CRITICAL** — severe operational or regulatory impact
- **HIGH** — major business disruption risk
- **MEDIUM** — contained but meaningful impact
- **LOW** — limited impact

Criticality drives prioritization in review planning.

### Dependency Type

How replaceable the supplier is in practice:
- **Single** — no viable alternative (highest concentration risk)
- **Dual** — active secondary option exists
- **Replaceable** — can be swapped with manageable effort

Use this to distinguish security risk from continuity risk.

### Network Access Level

Supplier's level of network reach into your environment:
- **None** — no network connectivity
- **Limited** — restricted scoped access
- **Internal** — broad internal connectivity
- **Privileged** — highly sensitive or administrative network paths

Higher levels usually require tighter review cadence and compensating controls.

### Assessment Status

Current assurance state:
- **Not Started** — no assessment initiated
- **In Progress** — review underway
- **Completed** — latest review completed

Use with **Next Assessment Due** to identify stale assurance.

### Last Review Outcome

Result of the most recent supplier review:
- **Pass** — controls and evidence acceptable
- **Conditional** — accepted with follow-up actions
- **Fail** — unacceptable posture or missing critical evidence

Conditional and Fail outcomes should trigger tracked remediation actions.

### Contact Person

The person at the supplier you deal with day to day, for example an account manager or support lead.

### Contact Email

Email address of the supplier contact. Used when you need to reach the supplier about assessments or incidents.

### Contact Phone

Phone number of the supplier contact, including the country code (for example +1 555 0100).