You start from a blank page
You find the supplier, request the information, wait, and enter the data into your TPRM tool.
- 01FindIdentify the supplier and contact.
- 02RequestSend another questionnaire.
- 03WaitChase and copy the answers.
Supplier assessments, ready to use
RAY replaces exchanged spreadsheets with a controlled path: the supplier answers, Bright Cyde checks every piece of evidence, and every result goes through a double validation.
Each assessment keeps its context. The supplier gives its agreement before answering, and decides whether the detail goes to other clients.
Pilot programme · organisations and suppliers in the AFM (Association Familiale Mulliez) ecosystem
RAY / one assessment, four stages01–04
- 01 · ANSWER9 domains declaredby the supplier
- 02 · EVIDENCEEvidence attachedto the point it supports
- 03 · REVIEWValidated levelsagainst the level the client expects
- 04 · REPORTScore and conclusionafter a double validation
- TIME2 h the first time0 h for the next client
A dossier that moves with you
Before starting another assessment, check what already exists. RAY keeps declarations, evidence, and review in one thread.
For suppliers of the AFM (Association Familiale Mulliez)
One method, built with 8 companies of the AFM ecosystem
Does every client send you its own security questionnaire? With RAY, you declare once. Your company gives its agreement, and your dossier then serves the other clients under contract with Bright Cyde.
Who reads your evidence
Your evidence is encrypted in transit (TLS) and at rest (AES‑256), and hosted in France. Bright Cyde reads your answers and evidence for its analysis. A client that orders an assessment can download evidence if your company has given its agreement, authorised detail, and left that evidence selected under “Transmit to clients”. No evidence has a public address: every read goes through RAY, which checks that it belongs to your company.
What other clients receive
A contact of your company gives the agreement once for the whole company, before the first answer. It lets Bright Cyde share the score and the summary with its clients under contract: the overall score, the conclusion and its justification. The detail reaches them only with your authorisation, separate and optional: the validated levels, meaning the level Bright Cyde retains for each point, the per-domain scores, and the gaps between those levels and their expectations. You can withdraw either one, and the withdrawal applies from then on.
RAY / one assessment, several clients01–05
- 01 · YOU9 domains, your evidence
- 02 · REVIEWBright Cyde reviewsas the AFM’s cyber orchestrator, then a double validation
- 03 · REPORTYour clientreceives the report
- 04 · SCOREOther clients under contractthe score and the conclusion, computed on their expectations
- 05 · DETAILOn your authorisationvalidated levels and gaps
- EFFORTYour effort goes into the answer10 clients, 10 questionnaires: at least 30 h. With RAY: 2 h, once. Bright Cyde may return a point to complete.
Under NIS2 (Art. 21), your clients bound by the directive must manage the security of their direct suppliers. With RAY, one up-to-date assessment spares you one questionnaire per client.
Did you receive an invitation? The link in your email, on ray.bright-cyde.tech, is personal to you: open it to answer.
No invitation? Answering a tender, or going through an assessment with a company of the AFM ecosystem?
Get my company assessedor write to contact@bright-cyde.com
An authorisation to withdraw? Write to us: contact@bright-cyde.com
The same supplier, two ways to work
For Bright Cyde’s clients
The current process starts again with every request. The RAY model starts with the dossier already built.
You start with what is already known
RAY keeps the supplier dossier and its review. You reuse what still holds, then request a targeted update.
- 01CheckSee the dated score in your context.
- 02AuthoriseThe supplier opens detail when they choose.
- 03UpdateUpdate only what no longer suffices.
The supplier dossier
An answer does not disappear into a file
Declarations, evidence, and validation stay attached to the supplier. A new assessment can reuse them, confirm them, or request an update.
Reusable
The supplier does not repeat every answer without a reason.
In your context
The score stays dated and is read against your expected levels.
Controlled
The score and the summary travel with the supplier’s agreement. Detail depends on the supplier’s authorisation.
A useful score before you open another assessment
The RAY registry will give teams, tools, and eventually agents a starting point.
Supplier signalExample
- Supplier
- Logistics provider (fictional)
- Score
- 72 / 100, on your expected levels
- Gaps
- 6, 2 of them on access management
- Review
- 4 months ago, validated twice
- Reference
- AFM grid, 9 domains
- Detail
- on the supplier’s authorisation
Detail
Validated levels and gaps require the supplier’s authorisation.
API and MCP
Registry access and questionnaire assistance
We are preparing API and MCP access to the RAY registry for authorised clients. We are also preparing agent assistance for suppliers completing the questionnaire from their evidence, with an exact citation to each evidence file and source passage. These features are not available today.
The score and the summary travel with the supplier’s agreement. The detail remains subject to the supplier’s authorisation.RAY / authorised registryExample
Has the logistics provider (fictional) been assessed?
Score72 / 100, on your expected levels
Review4 months ago, validated twice
Statusup to date
Detailauthorised by the supplier
Sharing authorisation respected
One shared framework, distinct rights
RAY connects the teams commissioning assessments, the suppliers answering them, and the tools consuming the score.
Clients
Start with a structured assessment before requesting new data.
Suppliers
Answer through one process, and decide whether the detail is shared.
AFM
Connect the parties around a common reference.
Talk to us about your next supplier cycle
Describe your current process. We will see how the RAY model can reduce unnecessary repetition.