New Delhi, India — 7 October 2026 — Codec Networks Pvt. Ltd. today announced the launch of its Third-Party Risk Management (TPRM) & Supply Chain Cyber Risk Program, a structured service that helps organizations identify, assess, rate, monitor and report cybersecurity risk across their vendors, outsourced service providers, cloud platforms, technology partners, payment processors, data processors and critical operational suppliers.
Modern enterprises rarely operate alone. Critical business services increasingly run on cloud providers, SaaS platforms, payment service providers, managed service providers, software suppliers and professional advisors, and each of them widens the external attack surface. A weak vendor can expose customer data, disrupt a critical process, compromise an integration, introduce vulnerable software or become an entry point into the enterprise network. Regulators now expect material outsourcing to be overseen with evidence; boards expect consolidated visibility of vendor risk and unresolved exceptions. Yet in many organizations, vendor assessment is still a manual exercise run over email and spreadsheets.
Codec Networks’ program replaces that with a defined operating model. It covers vendor inventory and risk tiering, tier-wise security questionnaires, evidence review of policies, certifications, SOC and ISO reports, VAPT results, architecture and incident processes, security control validation across MFA, encryption, logging, EDR, vulnerability management, secure SDLC, backup, DR and privacy, vendor risk scoring, contract security review of DPA, breach-notification, audit-rights, subcontractor and exit clauses, remediation tracking and risk acceptance, continuous monitoring of critical vendors and board-level portfolio reporting.
“Most organizations know roughly how many vendors they have. Far fewer can say which ten could take down a critical service, which ones hold customer data, and which ones have an open finding nobody has chased for six months. This program gives management that list, with the evidence behind it, and keeps it current.”
— Piyush Mittal, Director Business Governance, Codec Networks Pvt. Ltd.
The program uses a tiered model so effort goes where exposure is highest. Critical vendors receive a full questionnaire, evidence review, contract review, security interview and remediation governance, reassessed annually and on any triggering event. High-risk vendors get a detailed questionnaire with selected evidence review; medium-risk vendors a standard questionnaire with self-attestation; low-risk vendors a basic attestation and contractual checks at onboarding. A weighted scoring model combining business criticality, data sensitivity, system access, control maturity, privacy and contractual controls, resilience, external exposure and remediation status produces a 0–100 residual risk score and a Critical / High / Medium / Low rating with a defined management action for each band. Codec can also align to a customer’s existing scoring methodology.
Four commercial models are available: a Per-Vendor Assessment for one-time reviews, a TPRM Batch for 50 to 500 vendors with tiered depth, a monthly TPRM Retainer covering onboarding, reassessment, remediation tracking and portfolio reporting, and a dedicated TPRM SPV assessment pod for banks, insurers, global enterprises and consulting firms, delivered under client-controlled access with no local data storage and measured on throughput, quality score, evidence-review turnaround and ageing. Consulting and audit firms can engage Codec as a white-label or co-delivery assessment factory.
Optional add-ons include TPRM policy and procedure development, a vendor portal with questionnaire and evidence workflow, the BoardCyberView vendor dashboard, a contract security clause library, external attack-surface monitoring for critical vendors, critical-vendor deep dives and a cyber-insurance vendor risk pack. The program aligns with ISO/IEC 27001:2022, ISO/IEC 27036, NIST CSF, NIST 800-53 and 800-161 supply-chain concepts, SOC 2, PCI DSS, DPDPA and GDPR-style privacy principles, and the outsourcing and cyber expectations of RBI, IRDAI and SEBI.
The Third-Party Risk Management & Supply Chain Cyber Risk Program is available immediately to banks, NBFCs, insurers, fintechs, SaaS enterprises, healthcare chains, telecom companies, manufacturing groups, e-commerce platforms, consulting firms and overseas financial institutions.