RiskXchange
UK buyer’s guide · 2026

The best TPRM software in the UK for 2026, compared.

The main third party risk management platforms headquartered in the UK are RiskXchange, Risk Ledger, SureCloud and ISMS.online. UK buyers also shortlist global platforms such as OneTrust, ProcessUnity, UpGuard and Bitsight. The right choice depends on whether you need UK data hosting, pricing in pounds, and reporting against FCA, PRA, DORA and Cyber Essentials requirements.

Last reviewed by Darren Craig

What is the best TPRM solution in the UK?

It depends on which of four UK needs is driving the purchase.

  • UK public body buying through a framework: Risk Ledger or SureCloud, both listed on G-Cloud 15, or ISMS.online through a reseller.
  • FCA or PRA regulated firm, or a UK supplier to EU financial firms under DORA: a platform that builds the register and the board report from live supplier data. RiskXchange is built for this; the GRC suites cover it through configuration.
  • Mid sized UK firm that wants a price before a sales call: RiskXchange publishes all three tiers in pounds, from £14,900 a year. UpGuard publishes an entry tier.
  • Certification first, suppliers second: ISMS.online, where supplier management sits inside the ISO 27001 workspace.
  • Third-party risk inside an existing global GRC or privacy platform: OneTrust or ProcessUnity.

UK headquartered TPRM platforms

Alphabetical. Headquarters checked at Companies House and on each company’s own site on 14 November 2026.

ISMS.online

Best for: UK organisations building an ISO 27001 or similar management system that want supplier management in the same place.

ISMS.online is a compliance platform run by Alliantist Limited, a company registered in Brighton (Companies House 04922343). Its focus is the management system itself: policies, risks, controls and audits, with a supply chain module that brings suppliers into the same workspace (ISMS.online pricing page). Its trust centre says its primary hosting supplier is based in the UK, and it is available on G-Cloud 15 through a reseller, Bridgeall.
Strengths
  • Supplier management sits next to the ISO 27001 controls it evidences
  • UK company, registered in Brighton
  • Primary hosting in the UK, by its own statement
  • Suits teams whose first goal is certification rather than supplier monitoring
Ask in the demo
  • Is supplier risk assessed from live outside-in data, or only from what the supplier tells you?
  • How does the supply chain module scale past a few dozen suppliers?

Pricing: Quoted on request.

Risk Ledger

Best for: UK public sector, critical national infrastructure and financial services teams that want suppliers to share one security profile across many customers.

Risk Ledger is a London company (Companies House 10831970; office at Churchill House, Old Street) that runs a network model: a supplier completes one profile and shares it with every customer on the network, and joining is free for suppliers (Risk Ledger pricing). It has a G-Cloud 15 listing on the Digital Marketplace, and its site has dedicated pages for the public sector, critical national infrastructure and financial services.
Strengths
  • Network model: one supplier profile, many customers
  • Free for suppliers, which helps response rates
  • Listed on G-Cloud 15, so UK public bodies can buy it through the framework
Ask in the demo
  • How many of your own suppliers are already on the network, and how current are their profiles?
  • Is there outside-in scanning of the supplier, or does the view depend on the profile they share?

Pricing: Quoted. The pricing page offers "Get pricing" rather than a list price.

RiskXchange Our product

Best for: UK and EU regulated teams that need DORA, FCA and PRA evidence produced from live supplier data, at a published price in pounds.

RiskXchange is a London company (Companies House 10996380) and the publisher of this page. It combines its own outside-in scanning of every supplier with questionnaires that AI agents pre-populate from documents the supplier already holds, chase to completion and cross-check against the scan. Reports against DORA, NIS2 and other frameworks are built from that live data. Tenant data stays in the region chosen at onboarding, with UK, EU and US environments (platform pricing FAQ).
Strengths
  • All three annual prices published in pounds, with unlimited seats and no setup fees
  • UK data hosting, chosen at onboarding
  • Supplier answers and outside-in evidence on the same record, compared automatically
  • Supplier follow-up run by an agent, not a reminder email
Ask in the demo
  • Bring a real SOC 2 report and a supplier who has gone quiet, and watch the questionnaire fill and the chase start on your data.
  • We are not on G-Cloud today, so a public body would need another route to buy.

Pricing: Published: Essentials £14,900 a year (50 vendors), Professional £31,500 a year (150 vendors) and Enterprise from £75,000 a year (unlimited vendors). GBP, excluding VAT. See pricing.

SureCloud

Best for: UK and European organisations that want third-party risk as one module of a wider GRC platform.

SureCloud is a London company founded in 2006 (Companies House 05703655), headquartered in the UK with offices in the US (SureCloud about us). Third-party risk is one module alongside compliance, risk, audit and resilience. It has G-Cloud 15 listings for its Enterprise and Foundations GRC products on the Digital Marketplace.
Strengths
  • Third-party risk alongside the wider GRC programme
  • UK headquarters and a long track record
  • Listed on G-Cloud 15
Ask in the demo
  • Is outside-in monitoring native, or an integration you license separately?
  • How much of the questionnaire work is automated rather than configured workflow?

Pricing: Quoted.

Global platforms UK buyers also shortlist

Shorter entries. Each has a fuller profile in our global buyer’s guide.

  • OneTrust. Best for organisations already running privacy or GRC on OneTrust. Its North America headquarters is in Atlanta (OneTrust contact page). Ask which modules you need and how they are priced together. Full profile.
  • ProcessUnity. Best for configurable workflow plus a shared exchange of completed assessments. Based in Concord, Massachusetts (ProcessUnity contact page). Ask how many of your suppliers already have a current assessment in the exchange. Full profile.
  • UpGuard. Best for a self-serve start with a published entry tier. US headquarters in Mountain View, California, with offices in Australia (UpGuard contact page). Ask what changes between the published tier and the quoted ones. UpGuard alternatives.
  • Bitsight. Best where a security rating must carry weight with a board or regulator. Ask how price scales as the number of monitored suppliers grows. Bitsight alternatives.

UK comparison table

The four questions UK buyers ask first. “Not confirmed” means we could not find a public statement on 14 November 2026, so put the question to the vendor.

PlatformUK headquartersUK data hostingPrice published in poundsG-Cloud 15 listing
ISMS.onlineYes, Brighton (04922343)Primary hosting supplier in the UK (trust centre)No, quoted (plans)Through a reseller, Bridgeall (listing)
Risk LedgerYes, London (10831970)UK and EEA, per its G-Cloud listing (listing)No (pricing page)Yes (listing)
RiskXchangeYes, London (10996380)Yes, chosen at onboarding (FAQ)Yes, all three tiers (pricing)No (search)
SureCloudYes, London (05703655)United Kingdom, per its G-Cloud listing (listing)No, quoted (plans)Yes (listings)
OneTrustNo, Atlanta (North America HQ); London officeNot confirmedQuotedNot checked
ProcessUnityNo, Concord, MassachusettsNot confirmedQuotedNot checked
UpGuardNo, Mountain View, CaliforniaNot confirmedEntry tier publishedNot checked
BitsightNot confirmedNot confirmedQuotedNot checked

Checked 14 November 2026. “Quoted” for the global platforms follows the pricing check in our global buyer’s guide. FCA, PRA and Cyber Essentials reporting is left out of the table because no vendor, including us, publishes a comparable statement of it. Test it in the demo instead: ask for the report, generated live from your own suppliers.

The UK rules that shape the choice

What each regime expects a firm to be able to show about its suppliers.

FCA and PRA outsourcing rules. The FCA expects firms that use outsourced and third-party providers to take responsibility for managing the risk, with more risk management as dependence grows, under SYSC 8 and related rules (FCA: outsourcing and operational resilience). The PRA’s supervisory statement SS2/21 expects firms to assess the materiality and risk of every third-party arrangement and to notify the PRA before entering a material outsourcing (Bank of England: SS2/21). See TPRM for financial services.

Operational resilience. In-scope firms had until 31 March 2025 to show they can stay within impact tolerances for each important business service (FCA: operational resilience). Suppliers that support those services need to be mapped and tested. See operational resilience.

Cyber Security and Resilience Bill. Introduced to Parliament on 12 November 2025, it reforms and adds to the NIS Regulations 2018, with provisions on managed service providers and designated critical suppliers (gov.uk: Cyber Security and Resilience Bill). See what the Bill means for suppliers.

Cyber Essentials. The government-backed scheme covers five technical controls (NCSC: Cyber Essentials), and many UK buyers ask suppliers for it. See the Cyber Essentials checklist and Cyber Essentials Plus.

UK GDPR. Article 28 requires a contract with every processor that sets out, among other terms, that it processes only on your documented instructions and uses sub-processors only as agreed (ICO: what needs to be included in the contract). See TPRM for data protection teams.

DORA, for UK suppliers to EU firms. DORA has applied since 17 January 2025 and requires EU financial entities to keep a register of their ICT arrangements (EBA: DORA registers of information). A UK supplier to an EU bank or insurer will be asked for the data that fills it. See DORA vendor management requirements.

What UK buyers pay for TPRM software

Most vendors in this guide quote on request. Ours are published, in pounds, excluding VAT.

RiskXchange tierAnnual priceVendorsAssessments a yearSupport
Essentials£14,9005025Email, self-serve onboarding
Professional£31,500150200Priority, guided onboarding, dedicated customer success manager
EnterpriseFrom £75,000UnlimitedUnlimitedPremium with SLA, white-glove onboarding, dedicated customer success manager

Every tier includes unlimited user seats and no setup fees. At 150 suppliers, Professional works out at about £210 per supplier a year. Source: /pricing/platform.

Disclosure

RiskXchange publishes this page and sells one of the products on it. We have tried to describe competitors as their own customers would recognise them, and every fact about another company links to its source. Treat this as a well-informed and interested source, and check it against something we did not write.
Questions

UK buyers, answered.

What is the best TPRM solution in the UK?
The UK headquartered TPRM platforms are RiskXchange, Risk Ledger, SureCloud and ISMS.online, and UK buyers also shortlist OneTrust, ProcessUnity, UpGuard and Bitsight. Choose on four UK questions: whether you need UK data hosting, a price in pounds before a sales call, a G-Cloud listing, and reports for FCA, PRA, DORA and Cyber Essentials built from live supplier data.
What is the best TPRM software for UK financial services?
Shortlist platforms that can show the PRA’s SS2/21 expectations and the FCA operational resilience rules from live supplier data: a materiality assessment for every arrangement, mapping to important business services, and exit plans for material outsourcing. RiskXchange is built for this, at a published price from £14,900 a year. See TPRM for financial services.
What is the best TPRM software for the UK public sector?
A public body buying through G-Cloud needs a listed supplier. On 14 November 2026, Risk Ledger and SureCloud had their own G-Cloud 15 listings on the Digital Marketplace, ISMS.online was available through a reseller, and RiskXchange was not listed.
What is the best TPRM software for a UK mid sized firm?
Favour published pricing, unlimited seats and automation of supplier follow-up, because a mid sized team is short of time rather than method. RiskXchange publishes all three tiers in pounds: Essentials £14,900 a year (50 vendors), Professional £31,500 a year (150 vendors) and Enterprise from £75,000 a year (unlimited vendors), excluding VAT.
Which TPRM platforms host data in the UK?
RiskXchange runs UK, EU and US environments, and tenant data stays in the region chosen at onboarding. ISMS.online says its primary hosting supplier is in the UK. The G-Cloud listings for Risk Ledger (UK and EEA) and SureCloud (United Kingdom) state UK data locations. For the global platforms, ask each vendor where your data and your suppliers’ data will be stored.
Keep reading

Related reading.

Best TPRM software 2026
Fifteen platforms compared, worldwide.
TPRM for financial services
FCA, PRA and DORA, and which platform suits which firm.
DORA third-party risk
The seven obligations and the register of information.
Platform pricing
Our three tiers, published in pounds.
Customer support
Support, onboarding and customer success by tier.

Put a UK platform on your shortlist.

Book a 30-minute call and we will run the demo tests from our buyer’s guide on your own suppliers.

Book a 30-min demo →See pricing