RiskWatch
RiskWatch International · Founded 1993 · Annapolis, MD, USA
Mid-market supply-chain risk platform with ISO 28000, C-TPAT, TAPA, UFLPA, and CSRD libraries pre-mapped.
Summary
RiskWatch ships a risk and compliance assessment platform built around pre-mapped control libraries for 40+ regulatory frameworks including ISO 28000 / 28001 supply-chain security management, C-TPAT Minimum Security Criteria (importer, carrier, broker, marine port authority roles), TAPA FSR and TSR cargo standards, AEO mutual-recognition, UFLPA-aligned forced-labor due-diligence controls, CSRD ESRS S1 to S4-aligned value-chain-workers controls, NIST 800-161 r1 cyber supply chain risk management, OFAC sanctions screening control families, ISO 27001:2022, NIST 800-53 r5, NIST 800-171 r3, CMMC 2.0, and ASIS Facility Physical Security Control Standards. The platform runs on a survey-based assessment engine plus an evidence vault and a cross-mapping engine that auto-detects shared controls across ISO 28000, C-TPAT, TAPA, AEO, and UFLPA so customs-broker, procurement, and supplier-risk teams draw from the same evidence vault. Supply-chain customers include 3PLs, contract manufacturers, freight forwarders, regional shippers, and federal supply-chain primes. The product has been in the field since 1993, and single-tenant deployment is available for ITAR / EAR-controlled defence supply chains and EU customs-broker data residency.
Strengths
- Pre-built control libraries for ISO 28000 / 28001, C-TPAT MSC, TAPA FSR / TSR, AEO, UFLPA-aligned forced-labor controls, CSRD ESRS S1 to S4-aligned value-chain controls, NIST 800-161 r1 cyber supply chain, and OFAC sanctions screening control families in one tenant
- Cross-mapping engine auto-detects shared controls across ISO 28000, C-TPAT, TAPA, AEO, UFLPA, and CSRD so procurement, customs, and ESG teams reuse evidence rather than rebuild it
- 33-year operating history; customer-audit response packs are first-class output, useful when a Tier-1 retailer, DoD prime, or EU customs authority requests an ISO 28000 or C-TPAT evidence pack
- Vendor / supplier risk management with BAA + SOC 2 + cyber-supply-chain tracking for tier-1 supplier audits across multi-3PL networks
- Single-tenant deployment with customer-owned data residency, an advantage for ITAR / EAR-controlled defence supply chains and EU customs-broker buyers with GDPR data-locality requirements
- Survey-based assessment engine works for non-technical control owners (procurement managers, customs clerks, supplier-quality engineers) without a workflow-builder learning curve
- Physical security assessment module (ASIS-aligned) for warehouses, distribution centres, cross-docks, and marine terminals with crime-data overlay; pairs naturally with supplier-site assessments
- Published support tier ladder (Standard $99/month, Professional $36K/year, Enterprise quote-only), not gated demos before you see what comes with each tier
Weaknesses
- No native multi-tier supplier-graph at Everstream Analytics or Resilinc depth; manual supplier-audit workflow rather than a 450,000-supplier mapped network with sub-tier-N visibility
- No native predictive disruption sensing at the Everstream EventWatchAI level; relies on customer-fed risk inputs rather than AI-driven SKU and lane-level disruption forecasting
- No native supplier sustainability rating network at the EcoVadis 130,000-rated-company scale; CSRD readiness lives in the assessment engine rather than a procurement-side network effect
- No native motor-truck-cargo or auto-liability claims module at Riskonnect or Origami Risk depth; pair with a dedicated RMIS if MTC claims volume is the load-bearing brief
- Public pricing is partial; Standard and Professional tiers published, Enterprise tier remains quote-only because deployment topology varies materially across multi-region supply chains
- Brand awareness on G2 and Capterra is lower than Riskonnect, Resolver, or MetricStream for the enterprise supply-chain buyer cohort; total third-party review volume sits below 100
Mid-market and regulated-industry supply-chain buyers (500 to 5,000 employees, 100 to 2,000 active suppliers) running ISO 28000 + C-TPAT + TAPA + UFLPA + CSRD + sanctions + cyber-supply-chain in one tenant who also want supplier-audit response packs and physical-security assessment in the same evidence vault.
Tier-1 OEMs whose dominant requirement is sub-tier-N supplier-graph visibility across 100,000+ suppliers; Everstream Analytics or Resilinc fit that brief better. Also wrong for procurement organisations whose dominant requirement is supplier sustainability scorecards across 50,000+ trading partners; EcoVadis fits that brief better.
Key features
- Pre-built control libraries for ISO 28000 / 28001, C-TPAT MSC, TAPA FSR / TSR, AEO, UFLPA-aligned, CSRD ESRS S1 to S4-aligned, NIST 800-161 r1, OFAC sanctions, ISO 27001:2022, NIST 800-53, NIST 800-171, CMMC 2.0
- Cross-mapping engine that auto-detects shared controls across supply-chain-security and ESG frameworks
- Survey-based supplier risk assessment engine for non-technical procurement and customs staff
- Evidence vault with versioning and customer-audit-ready export packs (Tier-1 retailer, DoD prime, EU customs)
- Vendor and supplier risk management with BAA, SOC 2, cyber-supply-chain, and SBOM tracking
- Policy management with approval and attestation workflows for supplier code-of-conduct and forced-labor due-diligence
- Physical security assessment module (ASIS-aligned) for warehouses, DCs, cross-docks, marine terminals
- Single-tenant deployment for ITAR / EAR and EU customs-broker data residency
Integrations
25+ native. Notable: Microsoft Entra ID (SAML SSO), Okta, Microsoft 365 / SharePoint, Slack, Jira, Salesforce, Custom REST API.
Target size
200 to 25,000 employees · US · Canada · EU · UK · AU