Never rebuilt
The deposit has not been compiled outside the vendor's infrastructure.
VENDOR RISK MANAGEMENT
Castler adds the missing step to your vendor risk assessment: a test that your critical vendors' software can be rebuilt and run without the vendor. Every verified release gets a signed Proof of Recovery.
Vendor risk assessment
Core banking vendor
Software recovery
Not testedProof of Recovery
Waiting for verification
Illustrative interface
A vendor risk assessment rates the vendor. It does not prove that the vendor's software can be recovered. Castler's figures for a typical institution show the gap:
40 to 60
critical vendors in the software estate
2 to 3
covered by deep verification today
98%
of the estate never independently verified
2 to 4 weeks
and $10,000 to $15,000 per verification
That is why vendor risk management covers only the few vendors that get deep verification.
Vendor risk management for software usually leaves four things open:
The deposit has not been compiled outside the vendor's infrastructure.
The runtime and operating procedure remain untested.
No signed evidence shows the system runs without the vendor.
The stored release may no longer match production.
Castler gives you vendor risk management for critical software vendors, built around one test: can you run the software without the vendor?
AI agents rebuild, deploy and replicate the vendor's application in a clean environment.
A named Castler engineer reviews the result and signs a numbered Proof of Recovery for your vendor risk assessment.
With Premium Recoverability, each new vendor release gets a new verification, so your vendor risk assessment stays current.
Run vendor risk management across every critical vendor in one control plane, starting with one application.
6 to 18 hours per codebase, at about 90% lower cost than current verification.
Always-current source, configuration and scripts are held in Castler's secure custody. Every release is captured.
AI agents rebuild, deploy and replicate the application. No vendor involvement and no documentation are required.
A named Castler engineer reviews the evidence and signs it.
You receive a numbered, signed pack for that exact release.
Add the pack to your vendor risk assessment as the recovery evidence for each critical vendor. This is vendor risk management that ends in signed evidence, not an opinion.
Each vendor risk assessment ends with a pack for that release:
Proof of Recovery pack
Independent build evidence for the deposited release.
A procedure your team can execute without the vendor.
Evidence that the declared production architecture was recreated.
A release-specific inventory of dependencies and components.
A current measure of verified recoverability.
A named engineer's signature on a numbered pack.
Boards, regulators, insurers and your recovery team can all examine the same pack.
A Castler vendor risk assessment finds these problems before you need the software back.
Standard Verification detects:
Premium Recoverability also detects:
Castler's platform runs vendor risk management in one view: every critical vendor, release, verification state, exception and signed Proof of Recovery.
Live verification status: mapping, rebuild, deployment, replication and engineer review for each release.
Release-by-release history: the evidence stays current when the vendor ships again.
Exceptions: missing dependencies, documentation drift, failed builds and unverified critical systems.
Audit-ready evidence: signed, numbered artefacts for boards, regulators, auditors, insurers and customers.
Jurisdiction-aware controls: choose the cloud and region, with role-based access and immutable audit trails.
Castler maps its evidence to 17 mandates across 9 jurisdictions, so your vendor risk management and vendor risk assessment records answer what regulators ask for.
Regulation
Castler evidence
Deposit, Build Report and Engineer's Seal
Deposit, Build Report and Engineer's Seal
Full Proof of Recovery pack
Deposit and Build Report
Full Proof of Recovery and Replication Report
Proof of Recovery and Deployment Runbook
MAS TRM and APRA CPS 230
Full Proof of Recovery pack
Pick the tier that fits your vendor risk management and vendor risk assessment needs:
$2,000
per application per year
Secure custody and a deposit report.
$3,500
per application per year
Adds build verification, SBOM and CBOM, with one verification per year.
$7,500
per application per year
Adds independent rebuild, deployment and run, a signed Proof of Recovery and verification of new releases.
Bundles for up to 10 applications: $7,500, $15,000 and $45,000 respectively.
No setup fee. Each tier includes everything in the tier before it.
FAQ
Vendor risk management is the process of identifying, assessing and controlling the risks that come from vendors. For software vendors, it includes proving that the software can be recovered if the vendor fails.
A vendor risk assessment is a review that rates the risks a vendor brings, such as financial, operational, cybersecurity, compliance and reputational risk. Castler adds a recovery test to that review.
For vendor risk management, Castler holds the vendor's current software, rebuilds and runs it in a clean environment and issues a signed Proof of Recovery for each verified release.
Not by itself. A risk rating does not show that the system runs without the vendor. Castler rebuilds and runs the software, and a named engineer signs the result.
Castler verification takes 6 to 18 hours per codebase. Castler lists traditional human-led verification at 2 to 4 weeks.
For vendor risk management, start with critical vendors, the ones whose failure would stop operations. Castler's example estate includes core banking, payment switch, risk and fraud, KYC, lending origination and treasury and reconciliation software.
Yes. You can begin vendor risk management with one critical application and expand verification across your software estate.
Castler's artefacts are designed to map to RBI IT Directions §12(f), RBI PSO Directions §17(c), SEBI CSCRF and the IRDAI Information and Cyber Security Guidelines 2023.
VENDOR RISK MANAGEMENT
Book a 15-min Demo. We will walk your software estate, name the regulation that applies to you and show you a real signed Proof of Recovery.
Book a 15-min Demo