Most organizations already review some vendors. Security looks at the big SaaS purchases, legal negotiates the contracts, and procurement tracks spend. What is usually missing is the connective tissue: one inventory, a consistent way to decide how much scrutiny a vendor deserves, a record of what was found, and a trigger to look again. A vendor risk program supplies that structure without turning every purchase into a month-long review.
Why auditors and regulators expect one
A 90-day rollout plan
Designing tiers that people will actually use
Tiering is what keeps the program proportional. Three or four tiers are usually enough. Base them on a handful of questions a business owner can answer at intake: what data the vendor will access, whether it connects to production or internal networks, how disruptive an outage would be, and whether a regulator or contract names it. Avoid scoring schemes with dozens of weighted inputs that nobody outside the risk team can reproduce. Our vendor tiering template gives a ready-made starting model.
- Critical: holds sensitive or regulated data at scale, or its failure stops a core service. Full questionnaire or independent report, contract review, and at least annual reassessment.
- High: accesses confidential data or internal systems with limited blast radius. Lighter questionnaire plus a report or certificate where available.
- Moderate: limited data, easily replaced. Basic security attestation at onboarding.
- Low: no data access and no system connectivity. Inventory record only.
Choosing a questionnaire
The Shared Assessments SIG is comprehensive and widely recognized, with a shorter version for lower-risk vendors. The Cloud Security Alliance's CAIQ aligns with the CSA Cloud Controls Matrix and suits cloud providers, many of which publish completed answers. A custom question set, such as our vendor security questionnaire, is faster to answer when kept short and targeted. Whichever you use, accept a current SOC 2 report or ISO 27001 certificate in place of questions it already covers.
Roles and common blockers
- Business owners request the vendor, answer tiering questions, and own the relationship and any accepted risk.
- Security or risk assesses higher tiers and rates findings.
- Procurement enforces the intake step so vendors cannot be onboarded around the process.
- Legal maintains contract clauses and negotiates when vendors push back.
- Blocker: shadow purchasing. Card-expensed SaaS never passes through procurement, so discovery through SSO and expense data matters.
- Blocker: questionnaire fatigue. Oversized questionnaires sit unanswered for weeks; match depth to tier.
- Blocker: findings with no consequence. If nobody decides whether to accept, mitigate, or walk away, assessments become paperwork.
After onboarding: monitoring and exit
- Reassessment dates set by tier and tracked, not left to memory
- Report and certificate expiry dates recorded, with requests sent before they lapse
- Triggers for early review: a vendor breach, acquisition, new data types, or a major service change
- Fourth parties recorded for critical vendors, especially their own hosting and subprocessors
- Offboarding steps covering access removal, data return or deletion, and confirmation in writing
Measuring the program and running it in Asurvo
- Percentage of vendors in the inventory with an assigned tier and business owner
- Critical and high vendors with a current assessment, and the number overdue
- Median days from intake to approval, by tier
- Open vendor findings by severity and age, and the count of formally accepted risks
- New vendors discovered outside the intake process each quarter
In Asurvo's Third Party module, the vendor inventory, tiering, questionnaires, risk scoring, and continuous monitoring share one workspace, while the risk register tracks third-party risk treatment plans with owners and deadlines. For deeper background on design choices, read the full vendor risk program guide.