Rate a third-party vendor's risk from the data they access, the certifications they hold, and how critical they are to your business. The risk tier and recommended due diligence update live as you choose.
The biggest drivers are how sensitive the data they access is, how deeply they integrate with your systems, and how critical they are to operations. A vendor with broad access to customer data and no recognized certification is the classic high-risk case.
Yes. A current SOC 2 Type II or ISO 27001 report is independent evidence that the vendor operates real controls, so it lowers the residual risk. It does not eliminate it, and you should still review the report and any exceptions.
Use it to right-size due diligence. Low-risk vendors may need only a basic review, while high-risk vendors warrant a security questionnaire, evidence review, contractual security terms, and periodic reassessment.
Reassess high-risk vendors at least annually and whenever their access or your relationship changes materially. Lower-risk vendors can be reviewed on a longer cycle.
Yes, it is free with no signup. If you need a full third-party risk program or vendor assessment, our team can help.
Auditors and enterprise customers will ask how you vet your vendors. We help you stand up third-party risk management as part of your SOC 2 and security program.
See security & compliance Book a call