# FOCTTA TPRM - third-party and vendor risk management

> Tier vendors, send questionnaires, score risk with reasons you can read, and track incidents and exits for every processor.

Web page: https://foctta.com/tprm  
This Markdown copy has the same content as the web page. Built 2026-10-14.

---

FOCTTA TPRM

# Every vendor score shows the rule and clause behind it.

FOCTTA TPRM is third-party risk management software: it tiers every vendor that handles your data, collects their questionnaires and scores each one with its reasons. Built for RBI, SEBI, IRDAI and the DPDP Act .

[Book a demo](https://foctta.com/company) See how it works

A

C

B

Vendor incident · 7 clocks

Second approver required

How it works

## From the first quick-add to an exit a regulator can follow.

**01 Quick add**: Add a vendor and check its business IDs.
PAN, GSTIN, CIN, Udyam, IFSC and LEI checks.

**02 Tier by risk**: Readable rules place each vendor in a tier.
22 readable tiering rules, override by a second person.

**03 Send questionnaires**: Vendors answer online, with no account needed.
Campaigns through the vendor portal: one-time code, save and resume, uploads.

**04 Score with reasons**: Each vendor gets a band that shows why.
Explainable bands with citations: the rules that fired and the clause each one cites.

**05 Approve and onboard**: Checks must pass before a vendor goes live.
A 7-condition gate and a 12-step onboarding.

**06 Respond to incidents**: Track a vendor incident against regulator deadlines.
Incidents with 7 regulatory clocks.

**07 Exit with proof**: Offboard with a record that checks itself.
11 exit items and a self-verifying dossier.

Explainable by design

## Same inputs, same band. Every time.

6 Questionnaires, 665 questions

7 Regulatory clocks on incidents

15 Personas, from buyer to board

**Cloud payments processor** Tier 1 · personal data · cross-border

Band B

Why this band The rules that fired, the clause each cites, and each answer's source.

1 Processes customer personal data DPDP s.8(2)

2 Stores data outside India RBI Outsourcing 2025

3 Business continuity evidence missing ISO 22301

4 Encryption evidence verified ISO 27001

Scoring is rule-based and reproducible No AI decides your risk

**A portal vendors actually use**
Save and resume, file uploads, and a spreadsheet round trip.

**Maker-checker everywhere**
Enforced in the database.

**Tamper-evident evidence**
A SHA-256 evidence chain per customer, checked in one click.

**Incident exposure answer**
With 7 live regulatory countdowns.

**Exits a regulator can follow**
A sign-off chain per tier, legal holds and a self-verifying dossier.

**Account closure proof Needs setup**
The evidence comes from Microsoft Entra ID.

**Procurement clearance**
By API, or a CSV of up to 1,000.

**Contracts and DPAs**
19 document kinds with expiry, and 15 data elements per processing record.

**Board pack and reports**
8 management reports and a programme report for the board.

Content packs cite

The questionnaires and scoring rules cite these laws and standards.

RBI Outsourcing Risk 2025 SEBI CSCRF SEBI BRSR IRDAI DPDP Act 2023 DPDP Rules 2025 CERT-In 2022 ISO 27001 ISO 27701 ISO 22301 ISO 42001 SSAE 18 ISAE 3402 OWASP ASVS Companies Act

**Linked to FOCTTA Consent**
FOCTTA TPRM is its own product with its own console and sign-in. Today its vendor risks flow into the FOCTTA Consent risk register, and treatment decisions flow back.

## Show your regulator exactly why each vendor scored the way it did.

[Book a demo](https://foctta.com/company)