A vendor risk assessment answers one question: how much damage could this vendor cause us, and are its controls good enough for that? It is a decision about whether to work with a vendor, on what terms and how closely to watch it. A form can feed that decision, but a form alone cannot make it.
This guide shows a method that adds evidence you can collect without the vendor’s help. It builds on our earlier posts on why vendor security questionnaires don’t work and on continuous monitoring versus the annual audit, so it does not repeat their argument.
What a vendor risk assessment has to prove
Inherent risk and residual risk
Inherent risk is the harm a vendor could cause given what you hand over: data, access to your systems and a business process it runs for you. Residual risk is what is left after you count the vendor’s controls and your own.
Rate inherent risk first. It decides how deep the review goes. Evidence then moves you from inherent toward residual risk.
What regulators expect
Rules differ by market, but they point the same way. Here is what each of four texts says, in short.
- US banks: the interagency guidance from the Federal Reserve, FDIC and OCC, final as of 6 June 2023, describes a life cycle of planning, due diligence, contract negotiation, ongoing monitoring and termination. It says monitoring may be periodic or continuous, and more frequent for critical activities.
- New York: 23 NYCRR 500.11 requires a covered entity to keep written policies on identifying and risk-assessing third-party service providers, due diligence and periodic assessment based on the risk each one presents.
- EU: DORA Article 28 tells financial entities to manage ICT third-party risk inside their ICT risk framework, to keep a register of information on every ICT contract and to do due diligence before they sign.
- Australia: APRA CPS 230 requires a register of material service providers and a service provider management policy that also covers the fourth parties that material service providers rely on to deliver a critical operation.
None of these texts names a tool. They ask for a risk-based process you can show. Whether your process meets a given rule is a question for your compliance and legal teams.
Tier vendors before you assess them
Data access, system access and business criticality
Tiering stops you sending a 40-question form to a stationery supplier. Rate each vendor on three things: the data it holds, the access it has to your systems and how badly the business suffers if it fails. The highest of the three sets the tier.
The US guidance says each bank decides which activities and relationships are critical, and that a sound method for choosing them is a key part of the program. The table below is a common starting pattern. The intervals are ours to suggest, not a rule from any regulator.
| Tier | Criteria | Review depth | Frequency |
|---|---|---|---|
| Tier 1, critical | Holds sensitive data or has deep system access, or the business stops without it. | Full questionnaire, evidence, outside-in checks, contract review. | Yearly, plus continuous outside-in checks and triggers. |
| Tier 2, important | Limited data or access, and a workaround exists. | Short questionnaire and outside-in checks. | Every two years, plus triggers. |
| Tier 3, low | No sensitive data, no access to your systems. | Public information and a basic outside-in check. | At onboarding and at renewal. |
The inside-out half: questionnaires and documents
What SOC 2 reports and questionnaires can and cannot show
Questionnaires, SOC 2 reports, ISO 27001 certificates and policy documents show how a vendor says it runs security. They are the right place to check scope, ownership, incident duties and contract terms. Our vendor cyber risk questionnaire template gives you the questions and the evidence to expect.
They also have limits. They cover one period and one scope, and the vendor writes the answers. A report may leave out the very system that holds your data. That is why the second half matters.
The outside-in half: evidence you can check yourself
Outside-in means looking at a vendor the way an attacker does: from the internet, with no login and no help. It checks the questionnaire instead of replacing it. The free domain scanner gives a first view of any domain. It reports stolen logins from infostealer logs, breached accounts, dark web mentions and lookalike domains from public sources.
Exposed services, expired certificates and email security
Look for remote access, admin pages, file transfer and databases that answer from the open internet. Check that certificates on login hosts are valid and not close to expiry. Read the SPF and DMARC records of the vendor’s mail domain. If DMARC is missing or set to monitor only, receivers are not told to reject mail that fakes the vendor’s address. That mail may be aimed at you.
Leaked credentials and stealer logs naming the vendor’s domain
Infostealer malware copies saved passwords and session data from infected devices, and the logs are sold in bulk. A login for a vendor’s VPN, support portal or admin console can give an attacker the same reach the vendor has into your systems. Leaked credential monitoring covers this source for your own company, and the same idea applies to vendors.
Ransomware leak-site mentions and initial-access listings
A leak-site post means a ransomware group claims to hold a vendor’s data. An initial access listing means someone is selling a foothold in a network. Both are claims, not proof, so verify them before you act. Both still tell you to ask questions today, not at the next review.
The 2023 MOVEit case shows why. A joint advisory from CISA and the FBI says that, according to open source information, the CL0P group began exploiting CVE-2023-34362 on 27 May 2023. The advisory calls it a previously unknown SQL injection flaw in Progress MOVEit Transfer, a file transfer product, and notes that CL0P is also known as TA505.
A flaw in a file transfer product matters to you even if you never ran it, because your vendor may have. See our write-up of the MOVEit Transfer zero-day. Our ransomware intelligence page covers leak-site and access monitoring.
Lookalike domains that target the vendor’s customers
Attackers register domains close to a vendor’s name to send fake invoices or bank detail changes to the vendor’s customers. You are one of those customers. Watch for new registrations near the vendor’s name, as described in our post on lookalike domains and brand impersonation.
- Exposed servicesRemote access, admin pages and file transfer open to the internet.
- CertificatesValid dates and expiry on login hosts.
- Email securitySPF and DMARC records on the mail domain.
- Stolen loginsVendor domain in stealer logs and breach data.
- Leak sites and access salesThe vendor named in a leak post or access listing.
- Lookalike domainsNew registrations close to the vendor’s name.
Scoring and the decision
A simple scoring model: severity times tier
Give each finding a severity: 1 for low, 2 for medium, 3 for high. Give each vendor a tier weight: 3 for Tier 1, 2 for Tier 2, 1 for Tier 3. Multiply the highest severity by the tier weight.
A score of 1 to 3 means monitor, 4 to 6 means ask the vendor for a fix plan, and 7 to 9 means escalate now. The bands are an example; set yours with your risk team.
Take a fictional payroll vendor, examplepayroll.com. It holds employee bank details and connects to your HR system, so it is Tier 1 and its weight is 3. The outside-in checks find three things:
- Two employee logins in recent stealer logs, severity 3
- A certificate that expires in 12 days, severity 1
- A DMARC policy set to monitor only, severity 2
The score is 3 times 3, which is 9, so you escalate. The same finding at a Tier 3 vendor scores 3 and you monitor. The finding is the same, and the decision follows the tier.
When a vendor will not answer
Score what you can see, and treat the missing answers as unknown risk, not low risk. Write down the refusal, raise it with the contract owner and use renewal as the point to ask again. Outside-in evidence also gives you something concrete to send, such as the exposed login, instead of a general request.
Keep it current: triggers for re-assessment
Breach news, new exposure, M&A and contract renewal
A yearly date is a floor. The US guidance says risks can change over the life of a relationship, so banks may adapt their monitoring. Its list of monitoring factors includes changes in the vendor’s business strategy, financial condition, key staff and use of subcontractors. Turn that into triggers that start a fresh review:
- Breach news about the vendor or a product it runs
- A new outside-in finding, such as a fresh stolen login
- A merger, sale or change of hosting
- A contract renewal or a change in what the vendor can access
Our NIS2 and DORA third-party risk post shows how this fits EU duties.
Fourth parties: the vendors of your vendors
Your vendor depends on other companies too. The US guidance asks banks to weigh how much a vendor relies on subcontractors and whether one provider supports many activities. APRA’s policy requirement names fourth parties directly. NIST SP 800-161 Rev. 1 gives guidance on identifying, assessing and mitigating supply chain risk at all levels of an organization.
In practice, ask each Tier 1 vendor for its critical subcontractors and hosting providers, and include them in the outside-in checks. The supply chain and vendor risk use case shows this ranked view. The third-party risk management module maps vendor domains, subdomains, IP ranges, certificates, open ports and cloud assets, and watches dark web signals for early signs of a breach. It is built for the third-party risk role.
Last checked against sources on 19 October 2026.
To see this on your own vendor list, request a demo. If you want a first look today, run one vendor domain through the free domain scanner.