The idea behind it
Sending every vendor the same long questionnaire buries the security team and delays purchases of low-risk services. Sending none lets the vendors that hold the most sensitive data, or that operations cannot run without, through on the same terms as the office supplier. Tiering sets the effort in proportion to the risk. The 2023 interagency guidance from U.S. banking regulators describes more rigorous oversight for relationships that support higher-risk activities, including critical activities, and the same principle applies outside banking.
Tiering starts with inherent risk: the exposure the service creates before the vendor's controls are considered. The worksheet scores six questions from 0 to 3 and applies one rule. A high total sets the tier, but a single severe answer can too, because a vendor with privileged access to production is high risk even if it touches little data. Each tier then sets the questionnaire, the evidence, whether there is an on-site or virtual review, the contract clauses and the review frequency. For evidence, a SOC 2 Type 2 report includes the auditor's tests of controls and their results, and an ISO/IEC 27001 certificate should be checked for scope.
What's inside
- Six inherent-risk questions, each scored 0 to 3 with defined answers: data access, data sensitivity, system access, criticality to operations, regulatory scope and concentration.
- A tiering rule: criticality alone can make a vendor Tier 1, and sensitive data or privileged access alone makes it at least Tier 2.
- Due diligence by tier: questionnaire depth, security evidence such as a SOC 2 Type 2 report or ISO/IEC 27001 certificate, other evidence, on-site or virtual review, contract clauses and approver.
- Review frequency by tier and the events that trigger a reassessment at any tier.
- A vendor register that reads each vendor's requirements from its tier and flags overdue reviews.
- A worked example with eight fictional vendors, including one override.
Format: PDF (4 pages) and Excel workbook.
A look inside
Pages 1 and 2 of 4 of the PDF. Select an image to enlarge it.
Who uses it
- CISOs and third-party risk leads, to set due diligence in proportion to each vendor's risk.
- Procurement teams, to know before contracting which reviews and clauses a purchase needs.
- Business owners of vendor relationships, to answer the inherent-risk questions for the service they buy.
- Compliance and audit teams, to see that each vendor received the review its tier requires.
When to use it
- Every vendor receives the same questionnaire, and the backlog delays purchases.
- An audit or regulator asks how vendor oversight is matched to risk.
- A vendor breach showed that a critical supplier had never been reviewed.
- A new vendor is about to be given access to sensitive data or production systems.
How to use it
Score every vendor before contracting, run the due diligence its tier requires, put the tier's clauses in the contract, and reassess on the register's dates.
- List every vendor with access to your data or systems, or whose failure would disrupt operations, starting from accounts payable.
- Answer the six questions with the business owner for the service being bought.
- Read the tier from the rule; override only with a recorded reason.
- Run the due diligence the tier requires and put the tier's clauses in the contract before signing.
- Record the last assessment date and reassess on the register's next review date.
- Rescore when the service, data or access changes, after a breach at the vendor and at renewal.
You leave with: A tier for every vendor with the reasoning behind it, the due diligence and contract clauses each one requires, and a register that shows which reviews are overdue.
Where it goes wrong
- Scoring the vendor instead of the service. The same vendor can supply a low-risk service to one team and a critical one to another.
- Accepting a SOC 2 report or ISO/IEC 27001 certificate without checking that its scope covers the services you buy.
- Tiering once at onboarding and never again, although the data and access a vendor has tend to grow.
- Leaving physical access out of scope. The worked example overrides a cleaning contractor to Tier 3 for after-hours access to the server room.
Get the worksheet
It is free. Enter your work email and we send the download link.
Questions
What is inherent risk in third-party risk management?
The risk a vendor relationship creates before the vendor's own controls are taken into account: what data it can reach, what access it has, how much operations depend on it, what rules apply and how hard it would be to replace.
How does the worksheet assign a tier?
Tier 1 if criticality to operations scores 3 or the total is 13 or more; otherwise Tier 2 if the total is 8 or more, or data sensitivity or system access scores 3; otherwise Tier 3 if the total is 4 or more; otherwise Tier 4.
How often should each tier be reassessed?
The worksheet's starting point is every 12 months for Tier 1 and for Tier 2's evidence, every 24 months for Tier 3 and at renewal, up to 36 months, for Tier 4. The months can be changed, and any change in the service, a breach or a renewal triggers a reassessment.