TPRM vs contractor management: prequalification and CAE

TPRM manages the cybersecurity, continuity and compliance risk that suppliers bring to your information and services; contractor management and prequalification (CAE in Spain) check that whoever works on your site or premises meets occupational safety rules, accreditations and insurance. They share suppliers and evidence but measure different risks, so integrate them rather than merging them.

The difference between TPRM and contractor management

Both disciplines look at the same universe, your third parties, with a different question.

On the TPRM side, NIS2 requires entities to manage supply chain security and to take into account the vulnerabilities specific to each direct supplier and the quality of their cybersecurity practices [1]; in finance, DORA keeps the entity fully responsible even when it outsources ICT services [2]; and NIST publishes guidance on cybersecurity supply chain risk management [3].

What CAE is (and what equivalents exist)

Business activity coordination (CAE, from the Spanish coordinación de actividades empresariales) is a concept from Spanish labour law. Article 24 of Act 31/1995 requires companies sharing a workplace to cooperate in applying prevention rules, requires the owner of the workplace to inform the others of the risks and emergency measures, and requires a company that contracts out work or services belonging to its own activity to monitor that its contractors and subcontractors comply with those rules [4]. Royal Decree 171/2004 develops it [5].

In construction there is also Act 32/2006 on subcontracting: it requires firms to have their own productive organisation and preventive resources, creates the Register of Accredited Companies, requires a subcontracting book on site and limits the levels of subcontracting in a chain [6]. Minimum health and safety provisions for construction sites are in Royal Decree 1627/1997 [7].

CAE is the Spanish term. Many countries have equivalent contractor safety prequalification schemes under other names and requirements; what matters when choosing a platform is the function (verifying and keeping a contractor's documentation current), not the acronym.

A platform that integrates TPRM with contractor prequalification

There are two kinds of product: contractor prequalification and coordination platforms, centred on prevention documentation and site access, and TPRM platforms, centred on a supplier's cyber risk, continuity and compliance. What links them is the supplier master: the same tax ID, the same contacts, the same contracts and the same subcontractors.

When you assess an offer that claims to cover both, check the depth of each half separately, and do not assume a platform that is excellent on one side is on the other. Useful questions:

• Do they share the supplier register, or must each company be entered twice?
• Can a supplier's criticality in TPRM shape what is asked in prequalification, and the reverse?
• Can you see a subcontractor, its accreditations and its cybersecurity posture in one place?
• What data is shared between modules and who can access each (prevention, procurement, security)?

A valid alternative is to keep two specialised tools and integrate them through the supplier master. HodeiShield covers the TPRM side; it does not document contractor prequalification or CAE document management, and we do not claim it.

How construction firms use TPRM platforms

What follows is our reading of reasonable use cases, not a market study or customer data. In a construction or development firm, the third-party risk that falls on the TPRM side tends to concentrate on:

1. Suppliers hosting project information: drawings, measurements, bids and tender data on collaboration, document management or modelling platforms.
2. Subcontractors and consultants with access to your networks or accounts (VPN, email, repositories).
3. Suppliers of machinery and connected systems that send telemetry or allow remote maintenance.
4. Concentrated dependencies: many projects resting on a single platform or supplier.
5. Long subcontracting chains, where the subcontractor's subcontractor touches data or systems. Spanish law limits subcontracting levels on site [6], but that does not cover their technology suppliers.

The sensible practice is to tier suppliers by criticality and ask each tier only for what is proportionate: for a subcontractor without data access, little more than a declaration and its certificates; for a platform hosting your projects, a full questionnaire, evidence and periodic review. On the site side, CAE follows its own path; what it gains is a shared list of companies.

Features of an operational TPRM platform

"Operational" means it is used every week, not that an annual questionnaire exists. Look for:

• Inventory and criticality tiering, with an internal owner for each supplier.
• Proportionate questionnaires and portals so the supplier can answer without friction, with analyst validation (an unvalidated questionnaire is a self-assessment).
• Evidence with expiry and a trace of who reviewed it.
• External signals (exposure, vulnerabilities, component lists) so you do not rely only on what the supplier declares.
• A decision register (onboarding, renewal, review, offboarding) and exit plans.
• Alerts and integration with your ticketing, email or SIEM tools.
• Reports for management and audit, and limits stated honestly.

According to the HodeiShield documentation, its third-party risk module offers a one-time-link questionnaire portal, periodic external scanning, daily CVE sync, a 0 to 100 score per supplier, supplier SBOMs and a decision register. It also states limits: scanning is periodic, not continuous; it only sees the dependencies you declare and does not discover your full chain; and it does not replace your procurement process.

IT resources to integrate a TPRM platform

A TPRM platform that integrates with other systems saves manual work, but integration has an internal cost. Ask the vendor and prepare your side:

From the platform vendor

• A documented API, with authentication, limits and a test environment.
• Webhooks (ideally signed) to push alerts to tickets, chat or SIEM.
• Single sign-on (SAML or OIDC) and roles with separate read and write permissions.
• Data export in open formats (CSV, JSON) and an audit log.
• Where data is hosted and who can access it.

From your organisation

• An owner of the supplier master data (procurement or finance) and its source (ERP).
• A technical person for the integration and security to review it.
• Legal and procurement for the contract and renewal flow.
• A clear rule for which alert becomes a task and for whom.

HodeiShield documents alert delivery to ServiceNow, Jira, Slack, Teams, email, SIEM, PagerDuty and Opsgenie, plus a signed webhook, and a read-only public API with a CLI. If you need single sign-on, ask: we do not document it on the product page.

How to evaluate TPRM platforms for your sector

1. Start from your real obligation. A financial firm needs an ICT provider register, exit plans and concentration (DORA [2]); an industrial or construction company, remote access and component risk; the public sector, the ENS.
2. Define who you will assess (how many suppliers, of what criticality) and what evidence it is reasonable to ask of them.
3. Ask for a trial with your data. A generic demo does not show it fits your sector.
4. Score everyone with the same matrix and note the declared limits.
5. Plan the integration before signing.

We have a guide with a rubric, the whitepaper How to Choose a TPRM Platform: Criteria for 2026, and HodeiShield publishes how to evaluate TPRM platforms by sector. If you are choosing a service provider rather than a platform, see how to choose a cybersecurity provider.

Our point of view

Integrating is not merging. A single supplier master and shared criticality criteria bring more than one tool that does everything halfway. For third-party cybersecurity we work on supply chain risk management and GRC consulting; the regulatory context is in the NIS2 supply chain guide.

Frequently asked questions

Does TPRM replace CAE?

No. CAE answers an occupational risk prevention obligation and TPRM a cybersecurity, continuity and compliance risk; one does not cover what the other requires.

Can I use a single platform for both?

It can make sense if it covers both halves in depth; check each separately. Keeping two integrated tools linked by the supplier master is also valid.

Which suppliers of a construction firm should go into TPRM?

Those that host project information, have access to your networks or accounts, or depend on connected systems. The rest, with proportionate control.

What do I need from IT to integrate a TPRM platform?

A master data source for suppliers, a person for the integration, a security review and a clear destination for alerts (tickets, chat or SIEM). Ask for an API, webhooks, single sign-on and export.

How do I know whether a TPRM platform suits my sector?

Start from the obligation that applies to you, test with your own suppliers and compare using a common rubric. Our criteria whitepaper includes a reusable matrix.

Next step

Want to review how you manage suppliers today? Tell us about your case or discover HodeiShield.

Sources

1. Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2). EUR-Lex (Official Journal of the EU), 2022-12-14. https://eur-lex.europa.eu/eli/dir/2022/2555/oj
2. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA). EUR-Lex (Official Journal of the EU), 2022-12-14. https://eur-lex.europa.eu/eli/reg/2022/2554/oj
3. Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (SP 800-161 Rev. 1 Upd. 1). NIST. https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final
4. Ley 31/1995, de 8 de noviembre, de Prevención de Riesgos Laborales. Boletín Oficial del Estado, 1995-11-10. https://www.boe.es/buscar/act.php?id=BOE-A-1995-24292
5. Real Decreto 171/2004, de 30 de enero, por el que se desarrolla el artículo 24 de la Ley 31/1995 en materia de coordinación de actividades empresariales. Boletín Oficial del Estado, 2004-01-31. https://www.boe.es/buscar/act.php?id=BOE-A-2004-1848
6. Ley 32/2006, de 18 de octubre, reguladora de la subcontratación en el Sector de la Construcción. Boletín Oficial del Estado, 2006-10-19. https://www.boe.es/buscar/act.php?id=BOE-A-2006-18205
7. Real Decreto 1627/1997, de 24 de octubre, por el que se establecen disposiciones mínimas de seguridad y de salud en las obras de construcción. Boletín Oficial del Estado, 1997-10-25. https://www.boe.es/buscar/act.php?id=BOE-A-1997-22614