Vendor Risk Assessment: A Practical Guide for Security Teams (With Scoring Model)

Most of the worst breaches of the last decade did not start at the victim company. They started at a vendor. Target (HVAC contractor), SolarWinds (software supply chain), Kaseya (MSP downstream), and hundreds of others.

Yet most vendor risk programs are a spreadsheet, an annual questionnaire nobody reads, and a checkbox. This guide shows you how to build one that actually catches risk - with a scoring model you can copy today.

What Vendor Risk Assessment Actually Is

Vendor risk assessment (VRA) is the process of identifying, scoring, and managing the risk introduced by third parties that touch your data, systems, or operations. It is a core requirement in ISO 27001 (Annex A 5.19-5.23), NIST CSF (Identify/Supply Chain), and most regulatory regimes.

The goal is not to eliminate vendor risk - that is impossible. The goal is to know which vendors can hurt you, how badly, and what you are doing about it.

Step 1: Build the Vendor Inventory

You cannot assess what you cannot see. Start by enumerating every vendor that:

• Stores, processes, or transmits your data (customer PII, employee data, financials)
• Has network or system access (SSO, VPN, admin consoles)
• Provides critical operations (payroll, hosting, payments, communications)
• Is embedded in your product (SDKs, APIs, subprocessors)

Sources: accounts payable records, SSO logs, contract repository, cloud billing, and asking team leads. Expect to find 30-50% more vendors than anyone guessed.

Step 2: Tier Your Vendors

Not all vendors deserve equal scrutiny. Tier by two axes: data access and business criticality.

Step 3: The Questionnaire (Ask What Matters)

Skip the 300-question SIG Lite dump for everyone. Ask targeted questions per tier. Core questions that catch real risk:

• Access: Do you store our data? Where (regions)? Do you have production access to our environment?
• Subprocessors: List all subprocessors touching our data. How do you notify us of changes?
• Security proof: Current SOC 2 Type II or ISO 27001? Most recent pen test summary?
• Incidents: Breach notification SLA? Have you had a reportable incident in 24 months?
• Controls: MFA everywhere? Encryption at rest and in transit? Logging and monitoring? Offboarding process?
• Resilience: Backups tested? DR plan? RTO/RPO commitments?

For Critical tier, demand evidence, not assertions: certificates, pen test executive summaries, and screenshots or policy excerpts where appropriate.

Step 4: The Scoring Model (Copy This)

Score each vendor 1-5 on four dimensions, then compute inherent and residual risk.

• Data Sensitivity (D): 1 = no data, 5 = bulk regulated/PII
• Access Depth (A): 1 = none, 5 = production admin
• Business Criticality (B): 1 = nice-to-have, 5 = operations stop without them
• Control Maturity (C): 1 = strong evidence, 5 = no evidence / weak answers

Inherent Risk = max(D, A, B) (how bad could it get). Residual Risk = Inherent x (C / 5) rounded up. Then map:

• Residual 1-2: Accept, monitor at renewal
• Residual 3: Mitigate - contract clauses + remediation plan
• Residual 4-5: Escalate - remediation with deadline, or replace vendor

Example: payroll provider with employee PII (D=4), SSO access (A=3), operations-critical (B=4) → Inherent 4. They produce SOC 2 Type II and clean pen test (C=2) → Residual = ceil(4 x 0.4) = 2 → Accept with annual review. Same vendor with no evidence (C=5) → Residual 4 → Escalate.

Run this in our Vendor Risk Assessment tool to generate the scored register automatically.

Step 5: Remediate and Contract

For every vendor above your risk appetite, do one or more of:

• Remediation plan: Written commitments with dates (e.g., "MFA on admin console by Q3").
• Contract clauses: Breach notification within 72h, right to audit, subprocessor approval, data return/deletion on exit, security requirements exhibit.
• Compensating controls: Restrict their access, segment network, DLP on exports, require SSO.
• Replace: If residual risk stays 4-5 after remediation attempts, start exit planning.

Step 6: Continuous Monitoring (The Part Everyone Skips)

Annual questionnaires go stale the day they are signed. Add trigger-based monitoring:

• Security rating services or news alerts for breach mentions
• Certificate expiry and subprocessor change notifications
• SSO/VPN access reviews quarterly for Critical tier
• Re-assessment on trigger events: acquisition, breach, major outage, scope expansion

Common Mistakes

• Assessing everything equally: You will drown. Tier first, always.
• Trusting self-attestation for Critical vendors: Ask for evidence.
• No owner per vendor: Every Critical/High vendor needs a business owner accountable for the relationship, not just security.
• Ignoring fourth parties: Require Critical vendors to disclose and manage their own subprocessors.
• Assessment without action: A scored register with no remediation column is decoration.

The Bottom Line

Vendor risk is where modern breaches live. A working program is: inventory → tier → targeted questionnaire → score → remediate → monitor. Six steps, one register, and the discipline to reassess on triggers.

Start this week: pull your accounts payable list, tier the top 20 vendors, and score them with the model above. You will find at least one Critical vendor with no evidence - and that is the one that would have been next quarter's headline.