Paste your vendor list. Get the register the regulator asks for by name.
Per vendor: what you depend on it for, the share of your spend and your systems that sit with it, the country the dependency lands in, the vendors with no fallback, the obligations DORA, NIS2 and NIST SP 800-161 attach to that relationship, the contract clauses each expects, and the DORA register entry. Eight vendors free, no account.
| Vendor | Spend | Share | Lands in | Contract end |
|---|---|---|---|---|
| Northlane Cloud single source no exit plan | €2,050,000 | 27.8% | IEIreland | 412 days |
| Anvil Pay Acquiring | €640,000 | 8.7% | IEIreland | 350 days |
| Cardinal Scheme Services no contract end | €310,000 | 4.2% | BEBelgium | not stated |
| Greyfriar Managed IT chain of two or more | €296,000 | 4.0% | INIndia | 180 days |
| Quillon Compute origin unconfirmed | €205,000 | 2.8% | DEGermany vendor country not stated | 150 days |
| Tidewater Staffing ends inside 90 days | €190,000 | 2.6% | DEGermany | 30 days |
| Ebbtide Bank single source | €142,000 | 1.9% | DEGermany | 545 days |
| Zorvane Analytics unrecognised | €42,000 | 0.6% | EEEstonia | 220 days |
| 38 vendors | €7,376,000 | 11 countries |
Paste the list you already have
The procurement export, the contract folder index or the spreadsheet the last audit produced: one vendor per line, with what it provides, the annual spend, the countries, the systems it touches, whether it is the only source and when the contract ends, in any order the header names. Every vendor is matched against a published dictionary of 45 categories in eight families; a vendor that matches nothing is marked unrecognised and never guessed.
Read what depends on each vendor, and where
Per vendor: the share of annual spend, the share of the systems named, the country the dependency lands in, the criticality as pasted or derived from the systems and the single-source answer, the days left on the contract. Per register: the largest vendor, the top three, the largest country, the vendors with no fallback, the contracts ending inside 90 and 180 days. Each figure is a comparison of your own columns, never a verdict on a vendor.
Take the obligations to the contract folder
Tick the regimes that reach you and each vendor carries the clauses that attach to the relationship: DORA Articles 28 to 31 and the key contractual provisions of Article 30, NIS2 Article 21(2)(d), 21(3) and 24, the NIST SP 800-161 supplier controls, ISO 27001 controls 5.19 to 5.23. Quoted from a human-verified compliance corpus under licence. The DORA register of information exports in the supervisory template's column order.
Why a register and not a vendor risk platform
The platforms are built for the bank with a procurement function and a licence budget. The vendor manager at a 600-person firm has a contract folder, a spreadsheet and a supervisor who now asks for the register by name. Before the platform conversation, somebody has to say what the business depends on each vendor for, where that dependency lands, which vendors have no fallback and which contracts carry the clauses the regime expects. That is the register this builds, in your browser, from the list you already hold.