SAMPLE REPORT · FICTIONAL DATA
See what your assessment looks like
A 19-page sample report on two fictional technology vendors: who controls them, where your data goes, and what to ask the supplier.
All organisations, vendors, people and events in this report are fictional.
FROM THE SAMPLE · PAGE 2
Key findings
- Vendor
- Kestrel Mobile Security SA
- Exposure index
- 25 / 100
- Highest area
- Jurisdiction & control: 100 (at maximum)
- Data processing locations
- LU · SG · HK
- Vendor
- Helvion Vault AG
- Exposure index
- 4 / 100
- Highest area
- Operational resilience: 12
- Data processing locations
- Switzerland
The index averages all eight areas using your weights, so one area at maximum exposure can sit behind a lower index. That's why the highest area is shown too.
Kestrel: 1 area at maximum exposure: Jurisdiction & control
All organisations, vendors, people and events in this report are fictional.
WHAT'S INSIDE
Key findings
The points that drive your exposure most, each dated and sourced.
Client Exposure Index
0 to 100 for each vendor, calculated from your context and your weights. It is not a universal rating of the vendor.
Eight exposure areas
Sanctions, ownership transparency, jurisdiction & control, operational resilience, cyber hygiene, supply chain, financial stability, regulatory alignment.
Event timeline
The most significant documented events per vendor, newest first.
Jurisdiction profile and map
Headquarters, ultimate owner, data locations and R&D footprint.
Questions for your supplier
Concrete contract and due-diligence questions drawn from the findings.
HOW YOUR CONTEXT SHAPES IT
Your answers never remove a finding. They change how much each type of finding weighs for your organisation. Two questions per vendor (how critical it is, and whether it handles sensitive data), then use our suggested priorities or adjust them.
Read the full sample
All organisations, vendors, people and events in this report are fictional.
Get this for your own critical vendors.
Start your shortlist. Answer two questions per vendor. Your report is built from your own context and issued to you alone.