Third-Party Vendor Risk Assessment
Know what you're actually exposed to before a vendor becomes your problem.
A focused, document-based review of a specific vendor or vendor set, their questionnaire answers, their compliance reports, and their contract terms, scored against your own risk tiers.
Request a Vendor ReviewWhat's Included
- Review of the vendor's completed security questionnaire, or a questionnaire issued if they don't have one on file
- SOC 2 / ISO 27001 report review, where the vendor can provide one
- A documented risk rating against your criticality tiers
- Contracts and DPAs/BAAs checked against the specific provisions regulations require, like HIPAA's BAA elements or GDPR Article 28
- Written findings and mitigation recommendations you can act on or hand to legal
What's Not Included
- Not a penetration test of the vendor's environment, no technical testing is performed
- Not a legal review. We check contracts and DPAs/BAAs against the specific provisions regulations require, like HIPAA's BAA elements or GDPR Article 28. We don't opine on enforceability, liability exposure, or negotiation leverage. Have your attorney handle that.
- Limited to the vendor or vendors in scope, not an ongoing vendor management program
Need an ongoing vendor management program instead of a one-time review? That's part of GRC & Compliance Advisory, or start with our free Vendor Management Policy Template.
How It Works
Intake & Scoping
Tell us which vendor, what they access, and what documentation you already have.
Evidence Request
We request or review the vendor's questionnaire, compliance reports, and relevant contract language.
Risk Review
Evaluate the vendor against your criticality tiers and identify gaps.
Findings & Recommendations
A written risk rating and mitigation plan you can act on.
Who This Is For
- You're onboarding a new vendor that will touch sensitive data or a critical system
- A customer or auditor asked how you vet your vendors, and you don't have a good answer yet
- A vendor's questionnaire response came back and you're not sure what to make of it
- You need a documented risk rating on file before signing a contract
Related Services
Security Assessments
Risk assessments, program evaluations, and multi-vendor reviews as part of a broader engagement.
GRC & Compliance Advisory
Build an ongoing vendor management program instead of a one-time review.
Security Questionnaire Completion
On the other side of this, get help answering a customer's questionnaire about you.
Not sure what a vendor's risk actually is?
Send us the vendor and what they'll have access to. We'll tell you what to ask and scope the review from there.
Request a Vendor ReviewLooking for a fixed-price, fast-turnaround version of this review instead? It's also available on Upwork.