How i2 Group uses Risk Ledger to evidence its own security and assure its suppliers

About i2 Group

i2 Group is a global leader in intelligence analysis software. Trusted by law enforcement, government agencies, national security organisations, and commercial enterprises worldwide, i2 empowers analysts and investigators to transform complex, disparate data into actionable intelligence. Its industry-standard solution portfolio — featuring the renowned i2 Analyst's Notebook — enables organisations to uncover hidden connections, visualise complex networks, and combat threats like organised crime, financial fraud, and terrorism. With over three decades of domain expertise, i2 delivers mission-critical capabilities that accelerate investigations and help build a safer world.

Key benefits for i2 Group

i2 Group uses Risk Ledger in two directions: to demonstrate its own security to customers, and to assure the suppliers it itself depends on.

As a supplier

• More than 40 of clients connected to its single, continuously maintained security profile.
• An estimated 60 to 70% of baseline assurance enquiries answered by the profile without significant additional work.
• An estimated two to four hours saved per baseline request, amounting to several working weeks of Security and Compliance effort a year.
• Security evidence introduced as soon as customers raise assurance in sales and bid conversations.

As a client

• An estimated 50 to 70% less administrative effort on initial reviews of suppliers that already have a complete profile.
• Updated supplier evidence available through live connections, without fresh requests.
• Dedicated AI control questions.
• Enhanced visibility of supply chain and cloud dependencies across the extended supply chain.

Across both roles

• An estimated one to two days of audit preparation is saved in each cycle, with evidence maintained through the year.
  ‍

‍

The challenge

As a supplier: a rising bar for the assurance customers expect

i2 Group supplies software to organisations in government, defence, national security and law enforcement, where a supplier's security is scrutinised closely. Dave Hart, Information Security Officer, explains that customers expect evidence that controls are designed, independently tested and operating in practice. That evidence includes ISO/IEC 27001 certification, SOC 2 reporting, Cyber Essentials, penetration testing summaries and the Statement of Applicability. Over the past two years, customers have also asked for more current evidence, greater visibility of supply chain and cloud dependencies, and clearer answers on resilience, privacy, secure development and, increasingly, AI governance.

The process for meeting that obligation was built around one customer at a time. Requests arrived through account managers, bid teams or partners as customer-specific spreadsheets, often with long lists of evidence requests attached. The Security Officer had to interpret each set of questions, find the latest certificates and policies, and gather input from product, legal and privacy colleagues. The material then went back by email or customer portal, with a manual record of which version of each document had gone to whom.

Every new customer added another round of near-identical work, and every evidence pack began to age the moment it was sent. For a supplier to high-assurance customers, the manual handling carried its own risk, because each emailed pack put another copy of sensitive evidence into circulation.

As a client: supplier assurance that depended on each supplier's willingness

i2 Group met the same model from the other side when it assessed its own suppliers. Those reviews also ran over email, and the speed and quality of the assurance depended on how willing each supplier was to engage:

Suppliers with little commercial incentive to engage could slow the process considerably, and those that did respond sent evidence in formats that each had to be interpreted afresh. Dave Hart wanted a process that was repeatable, risk-based and easier to evidence.

The solution

On Risk Ledger, a supplier completes one standardised security assessment, keeps it current, and shares it with every customer that connects. The assessment framework has been mapped against the control requirements of ISO 27001, Cyber Essentials, the NIST Cybersecurity Framework and the NCSC Cyber Assessment Framework, so customers can read the same answers against the standards they work to. More than 19,000 suppliers maintain profiles on the network, and joining is free for suppliers. i2 Group sits on both sides of this exchange. It maintains a profile its customers draw on, and it draws on the profiles its own suppliers maintain for many customers.

As a supplier: one profile, owned by Security

Dave Hart maintains i2 Group's profile and coordinates most assessment responses. Rosie Smith supports the wider compliance and governance evidence. Colleagues in product, engineering, IT, legal, privacy and sales contribute only when a request needs specialist or contract-specific detail. Account managers usually open the conversation with customers and bring Security in for qualification or follow-up:

As a client: comparable supplier data inside a risk-based process

Risk Ledger sits inside i2 Group's existing supplier management process. Tiering, sanctions screening, onboarding, risk assessment, certification checks, performance monitoring and review all remain i2 Group's own. The platform supplies the security evidence that feeds this process. Because that evidence comes in a standard format, suppliers can be compared with one another, and departures from the expected baseline are easier to spot and act on:

‍

Results as a supplier

A live profile in place of evidence packs

A static evidence pack, however complete, starts to age as soon as it is sent. A connected profile works differently. When i2 Group updates an answer or renews a certificate, every connected client sees the change, and each new connection reuses work already done. Forty-two clients are now connected to i2 Group's profile, with a persistent connection so they can see certificates update when they are renewed.

For organisations not yet on Risk Ledger, account teams share a secure link to the completed assessment, so prospects can view the latest approved material themselves. Dave Hart notes that this also keeps sensitive reports out of email and stops customer-specific copies from circulating. Dave Hart estimates the saving at two to four hours on a typical baseline request, more on evidence-heavy assessments, and several working weeks of Security and Compliance effort across a year.

Assurance earlier in the sales and bid cycle

Security reviews often arrive late in a bid, as a questionnaire that lands after commercial discussions are well advanced. Dave Hart explains that sales and account teams can now introduce credible evidence as soon as a customer raises assurance. That sets the expectation that i2 Group already holds a mature, reusable evidence set, and it can shorten the first round of due diligence. Account managers, Security and Compliance and, where needed, product, engineering, legal or privacy colleagues still take part, but they spend their time differently:

A baseline for most enquiries, with room for specific follow-up

A standardised profile is built to answer the common baseline. On Risk Ledger, suppliers can also add product-level answers and their critical fourth-party suppliers, which narrows the gap that bespoke questionnaires usually fill. Dave Hart estimates that i2 Group's profile meets around 60 to 70% of baseline enquiries without significant additional work. Roughly a third of cases still involve a bespoke spreadsheet or portal response, particularly for larger public sector, regulated and financial services customers. Even then, the profile usually supplies much of the underlying evidence.

According to Dave Hart, those requests are driven mainly by the customer's own mandated process, such as an internal template, a scoring system or a sector framework. Others ask for product-level detail, deployment architecture, data location or controls not suitable for wide publication. There are also more targeted questions on supply chain dependencies and AI governance. Dave Hart treats the profile and these follow-ups as complementary:

"We therefore treat Risk Ledger as the authoritative baseline, while retaining a route for proportionate, customer-specific follow-up."
‍

Results as a client

Faster reviews of suppliers already on the network

On the client side, the network effect works in reverse. A supplier that has already built its profile for other customers arrives with its evidence ready, and that profile has often been reviewed and queried by several clients before i2 Group sees it.

Monitoring has also become easier, because updated evidence now arrives through the connection without having to be requested again. Dave Hart is clear that the saving is smaller for suppliers that aren't yet on the platform or are slow to engage. Yet, even then, the workflow leaves a clearer audit trail.

Consistent questions on suppliers' use of AI

Risk Ledger's framework now includes a dedicated AI assessment domain. Clients can ask suppliers how they use AI, and suppliers answer as part of their standard assessment. Dave Hart explains that this gives i2 Group a consistent way to question suppliers that use AI or provide AI-enabled services, covering data use, governance, human oversight and ongoing risk monitoring. i2 Group's own customers now put similar questions to it.

‍

Supplier engagement support from Risk Ledger

Risk Ledger's team helps i2 Group bring suppliers onto the platform. The team identifies the right contacts, follows up invitations, investigates unclaimed or existing profiles, and prioritises suppliers that can be connected quickly. This has been most useful where a supplier already has a completed profile but hasn't yet accepted i2 Group's connection.

Where the two roles meet

Supplier oversight as evidence for customers

Organisations that use Risk Ledger as both supplier and client form the middle links of the network. Through them, dependencies further down the supply chain become visible. For i2 Group, that position also shapes the conversations it has with customers. Dave Hart notes that customers increasingly want visibility of supply chain and cloud dependencies, and that the profile supports earlier conversations about i2 Group's oversight of its own critical suppliers. Behind those conversations sits the oversight i2 Group carries out as a client, which now extends beyond its immediate suppliers to important cloud, software and fourth-party dependencies.

Audit readiness for ISO/IEC 27001 and SOC 2

Dave Hart describes audit preparation before Risk Ledger as a gathering exercise. Questionnaires, emails, certificates, contracts, review notes and risk records had to be pulled together from several locations, and each then had to be shown to be current. Now i2 Group can show auditors a consistent supplier assurance workflow, with Risk Ledger evidence alongside its Supplier Risks Register, supplier tiering, onboarding records and review history. That evidence also includes all the certifications that i2 Group holds, including ISO/IEC 27001, as well as a current SOC 2 Type II attestation and its full alignment with the NCSC Cloud Security Principles. Dave Hart estimates the saving at one to two days of preparation per audit cycle, but sees the larger benefit elsewhere:

i2 Group's September 2026 internal audit reviewed 84 supplier-risk records and assessed supplier governance as a particular strength.

Looking ahead

The risk Dave Hart watches most closely is concentration and opacity in the technology supply chain. Cloud platforms, open-source components, software build services and AI providers often sit several layers below the supplier i2 Group actually contracts with.

As a supplier, i2 Group expects the assurance it provides to move the same way: towards continuous evidence, visibility at product and component level, and notice of material changes. Dave Hart adds a caution. That transparency must not expose sensitive security information, and it must not create a workload that smaller suppliers cannot sustain. That is the case for a shared model, in which each organisation maintains its evidence once and shares it with every organisation that needs it.

‍