Who you buy from, and what you run on — both with a date against them.
Two registers that most businesses keep in two spreadsheets nobody owns. Suppliers carry an evaluation status, a risk assessment and a re-evaluation date. Systems carry an owner, a criticality profile and a review date. Both have a board showing what has lapsed, and both are on the weekly digest — so the work arrives instead of waiting to be looked for.
The same four steps for both halves. The fourth is the one that makes the first three matter.
Your suppliers and your systems, each with an owner — a person, not a department.
Criticality for a system, and what it holds. For a supplier, what happens to you if they stop.
A dated evaluation against the supplier, with a status and a cycle — annual, two-yearly, whatever you set.
Lapsed evaluations and overdue reviews appear on the board and in the owner's weekly email.
Most supplier registers have one column for approval, so a supplier you have never assessed looks identical to one you assessed in 2023 and forgot. They need different work from different people.
Grace separates them, and separates both from the one that actually matters on a Monday morning: a critical supplier that is not approved. That is a sentence somebody can act on, which “12 suppliers need review” is not.
Systems work the same way. A review date that nobody owns reminds nobody, so every system has an owner and the reminder goes to them.
Illustration — not a real workspace.
A named person. It is also who the review reminder goes to, which is the only reason an owner field is worth having.
Confidentiality, integrity and availability, rated separately — because losing access and losing control are not the same incident.
Whether it holds personal information, where the data sits, and whether it is reachable from the internet.
A review date, on the board and in the digest when it passes. A register with no clock goes stale in about a year.
If you are working toward ISO 9001, suppliers are clause 8.4 — control of externally provided processes, products and services — and the evaluation record is what the auditor asks for.
If you are working toward ISO 27001, suppliers are A.5.19 to A.5.23. The systems register answers ISO 9001 clause 7.1.3 — infrastructure — and feeds the information-asset inventory that ISO 27001 Annex A 5.9 asks for, which the ISO 27001 module holds. Link either record to the clause it satisfies and it shows up in that framework's readiness and in the evidence pack.
You do not need either standard for the registers to be useful. They are a way of managing a population, and the clause mapping is there if you want it.
Illustration — not a real workspace.
It does not monitor anything continuously, and it does not subscribe to an external risk feed. Nobody is watching your suppliers for news on your behalf. What it does is make sure that what you know is written down, owned, dated, and brought back to you before it goes stale.
It does not score suppliers for you. The evaluation is your judgement, recorded with a date and a name against it — which is what makes it evidence.
And it is not an asset management or configuration database. It is a register of the systems the business depends on, at the level somebody can actually keep current.
Bring the spreadsheet you keep suppliers in. Thirty minutes is usually enough to tell whether this is worth $100 a month to you.