A vendor risk assessment is more useful when it produces a documented decision, not simply a completed questionnaire. This guide provides a reusable workflow and vendor risk assessment template for classifying third parties, scoring inherent and residual risk, reviewing evidence, recording contract requirements, and setting practical reassessment intervals.
Overview
Third-party risk management connects procurement, security, privacy, legal, and business ownership. A supplier may process personal data, access production systems, store confidential information, support a critical business process, or introduce dependencies that are difficult to replace. The purpose of an assessment is to understand those exposures and determine whether the relationship can proceed, requires safeguards, or should be rejected.
A useful assessment separates inherent risk from residual risk. Inherent risk describes the exposure before considering the vendor's controls. Residual risk describes the exposure that remains after reviewing controls, contractual protections, compensating measures, and open remediation items. Keeping these concepts separate prevents a vendor from receiving a low score merely because it supplied polished documentation.
The assessment should also produce an auditable record. At minimum, retain the business owner, scope of services, data and system access, risk rating, evidence reviewed, decision rationale, required actions, contract status, and next review date. This record supports cybersecurity compliance, privacy compliance, audit readiness, and consistent procurement decisions.
For broader control context, compare the findings with your cloud security compliance checklist and, where relevant, your cloud compliance gap assessment for SOC 2, ISO 27001, and NIST.
Template structure
Use the following sections as a vendor security questionnaire and decision record. The format can be implemented in a spreadsheet, GRC platform, procurement system, or contract compliance tool.
1. Vendor and relationship details
- Vendor name, service name, website, and primary contact
- Internal business owner and procurement or legal contact
- Service description, business purpose, and expected start date
- Contract status, renewal date, and termination or exit considerations
- Criticality of the service and acceptable outage or recovery expectations
2. Scope, data, and access
- Types of data handled, such as public, internal, confidential, financial, health, or personal data
- Data location, storage model, retention period, deletion process, and subprocessor involvement
- Systems, accounts, networks, APIs, or physical locations the vendor can access
- Authentication method, privileged access requirements, and administrative responsibilities
- Relevant privacy obligations, contractual restrictions, and data transfer considerations
3. Inherent risk scoring
Score each risk factor before relying on the vendor's controls. A simple scale of 1 to 5 is usually easier to explain than a complex model:
- 1 — Low: limited data, no sensitive access, and a nonessential service
- 2 — Moderate-low: some internal information or operational dependency
- 3 — Moderate: meaningful business impact, recurring data processing, or system integration
- 4 — High: sensitive data, privileged access, important operations, or material privacy exposure
- 5 — Critical: a major dependency, broad production access, highly sensitive data, or difficult recovery and exit
Document the rationale for every high score. A practical overall inherent risk score can use the highest factor or a weighted average, but the method should be consistent and approved by the risk owner.
4. Evidence and control review
Request evidence proportionate to the risk. Possible evidence includes an independent assurance report, penetration test summary, vulnerability management policy, access review records, incident response plan, business continuity results, encryption details, privacy documentation, and a list of subprocessors. Record the evidence title, coverage period, scope, exceptions, expiry date, and reviewer conclusion.
Do not treat an attestation or certification as a complete answer. Confirm that its scope covers the service being purchased and that any exceptions are understood. A missing control may be acceptable with a compensating measure, a remediation deadline, or explicit risk acceptance.
5. Residual risk and decision
After reviewing evidence, score the remaining exposure using the same scale or a clearly documented method. Record one of four decisions: approve, approve with conditions, defer pending remediation, or reject. Conditions should name an owner, due date, verification method, and consequence if the action is not completed.
How to customize
Begin with a short intake form rather than sending every vendor the same lengthy questionnaire. Ask the business owner to identify the service, data, access, criticality, and expected users. Use those answers to route the vendor into a low, moderate, high, or critical review path.
Customize questions by risk. A low-risk marketing tool may need basic security, privacy, and contract answers. A cloud platform connected to production may require detailed questions about identity management, logging, vulnerability remediation, backup recovery, incident notification, change management, and subcontractors. A vendor handling personal data may also need a data processing agreement, processing instructions, retention terms, and assistance with data subject requests where applicable.
Align the questionnaire with your internal policies and control language. For example, findings from a vendor review may create follow-up work in your access review process, cloud configuration audit, or information security policy set.
Set scoring rules before reviewing a difficult vendor. Define which conditions automatically require security leadership or privacy review, when legal approval is needed, and who can accept residual risk. This avoids changing the threshold to accommodate a preferred supplier.
Keep procurement and security records connected. Contract terms should reflect the assessment: confidentiality, security responsibilities, incident notice, audit or assurance rights, subprocessor controls, data return or deletion, business continuity, and termination assistance should be considered according to the relationship's risk. The precise language should be reviewed by qualified legal counsel.
Examples
Example: low-risk collaboration tool
The tool is used by a small team, stores no regulated data, has no production access, and can be replaced without major disruption. The assessment may focus on account security, data ownership, basic privacy terms, support access, and deletion. A documented low residual risk decision and periodic reassessment may be sufficient.
Example: cloud infrastructure provider
The provider hosts customer workloads, supports privileged administration, and could affect availability and confidentiality. Inherent risk is likely high because of access and service criticality. The review should examine assurance scope, identity controls, logging, vulnerability management, resilience testing, incident handling, subcontractors, data location, and exit planning. Approval may depend on contract protections, technical isolation, restricted administrative access, and a time-bound remediation plan.
Example: data processor handling personal information
The assessment should map the processing purpose, data categories, retention, locations, subprocessors, deletion workflow, and support for privacy requests. A privacy review may run alongside the security review. Where the processing could create significant privacy risk, the organization should consider whether a privacy impact assessment or DPIA is appropriate and retain the reasoning behind that decision.
Use a risk register to track unresolved vendor issues rather than leaving them in email. The risk register template guide can help structure owners, scores, treatments, and review dates.
When to update
Set the reassessment interval from risk, not convenience. A low-risk supplier may be reviewed on a longer cycle, while a critical provider may require annual review, continuous evidence collection, or event-driven reassessment. The interval should be approved in your third-party risk management procedure.
Reopen the assessment when the vendor changes its service, ownership, hosting model, data use, subprocessors, access permissions, or incident history. Also reassess after a major contract renewal, material control failure, regulatory change affecting the relationship, or a change in your own system architecture.
At each review, compare the current evidence with the previous record. Check whether remediation items were closed, certifications or reports remain within their coverage period, contract obligations are being met, and access is still necessary. Continuous compliance monitoring can supplement, but not replace, a reasoned review; see these continuous compliance monitoring metrics for ideas on what to track.
Practical next step: copy the template structure into your assessment system, define your scoring thresholds, select three existing vendors, and complete a retrospective review. Use the results to remove questions that do not influence decisions, add evidence requests for recurring gaps, assign owners to open actions, and publish the next review date for every assessed supplier.
