Every Governli solution, in one place
Governli assesses suppliers on evidence rather than self-reported answers. Start from the assessment you need, or from the framework the supplier already documents against — each page explains what Governli reviews and what the resulting report contains.
One model behind every solution
- Vendor due diligence
- Vendor security assessment
- Cloud & SaaS assessment
- ISO 27001 · SOC 2 · GDPR/DPA
- 01Requirement
Your policy, baseline or framework
- 02Evidence
Supplier documentation, cited at source
- 03Finding
Found, partial, requested or manual review
- 04Decision
Recorded by a named reviewer
Whichever assessment you start from, the result is the same structure: requirements, the evidence mapped to them, the findings that remain, and a decision a person is accountable for.
Assessment solutions
Choose the assessment that matches the decision you need to make.
Vendor Due Diligence
Assess a supplier against your own requirements and receive a report with requirement-by-requirement evidence mapping, evidence strength, source citations, identified gaps and a decision recommendation.
Read moreRequirements-to-Evidence Mapping
The methodology behind every Governli assessment: your requirements on one side, the supplier's documentation on the other, and a traceable mapping between them.
Read moreVendor security assessment
Replace long security questionnaires with evidence. Covers identity and access, encryption, data residency, logging and incident response, continuity, vulnerability management, sub-processor governance and exit.
Read moreCloud & SaaS vendor assessment
For SaaS, IaaS and PaaS suppliers: review SOC 2 reports, ISO 27001 certificates and SoA, CSA CAIQ/STAR self-assessments, DPAs, security white papers, penetration test summaries and continuity plans.
Read moreThird-party risk management
Move from one-off reviews to portfolio-wide supplier risk, so vendor decisions and their evidence stay comparable across your supplier base.
Read more
Framework and document reviews
Most suppliers already document against a recognised framework. These pages explain how Governli reads that documentation and what it can — and cannot — prove.
SOC 2 report review
Read SOC 2 Type I and Type II reports for what matters: trust services criteria in scope, the audit period, exceptions and how they affect the service you are buying.
Read moreISO 27001 review
Validate certificate validity and issuing body, scope against the service you are buying, exceptions, the Statement of Applicability and excluded controls, and how they map to NIS2 and DORA.
Read moreGDPR & DPA review
Review the Data Processing Agreement, sub-processor list, transfer mechanisms and data residency claims against your GDPR requirements.
Read more
Further reading
Vendor-neutral guidance from the Governli Knowledge Center.