Draft
What is a vendor risk assessment?
By The Citesheet team · Published
Short answer
A vendor risk assessment (also called a third-party or supplier risk assessment) is the buyer's process for deciding whether a supplier is safe to use. The buyer works out how much risk the vendor poses, usually from what data and systems it will touch, then gathers evidence: a security questionnaire, audit reports such as SOC 2, policies and sometimes a call. The result decides whether the deal goes ahead and on what contract terms.
A vendor risk assessment is the process a company uses to check a supplier before (and while) it relies on it. Security is the biggest part for software vendors, but assessments can also cover privacy, financial health, legal and operational risk. It is one piece of what NIST calls cybersecurity supply chain risk management.
How it usually works
- Tiering. The buyer decides how risky the vendor is: what data it will hold, which systems it connects to, how critical the service is.
- Evidence. Low-risk vendors may get a short questionnaire. Higher-risk vendors get a longer one, such as a SIG Core or CAIQ, plus requests for a SOC 2 report, policies or a pen test summary. Shared Assessments describes its SIG as a tool to "scope, assess and evaluate vendor risk" (Shared Assessments).
- Review. The buyer's security team reads the answers, asks follow-up questions and flags gaps.
- Decision and contract. Approve, approve with conditions (often written into the contract or DPA), or reject.
- Reassessment. Many buyers repeat the review every year or when the relationship changes.
What it means for a vendor
The questionnaire is the part you see, but the reviewer is answering one question: "Can we trust this company with our data?" Clear, honest, evidence-backed answers make that easy. Answers that overclaim make it hard, because the follow-up questions will find the gap. Our guide on vendor security questionnaires covers how to answer one quickly without making things up.