Vendor Risk Scorecard
A free third-party risk management tool with two modes. Score a vendor across nine weighted domains — data access, certifications like SOC 2 and ISO 27001, encryption, MFA/SSO, subprocessors, breach history, incident-response SLA, continuity and right to audit — for a 0-100 assurance score, a Critical / High / Medium / Low risk tier, prioritised gaps and recommended contract clauses. Or generate a security questionnaire to send a vendor, as copyable Markdown. Everything runs in your browser; nothing is uploaded.
Inherent exposure · weight 18 / 100
How much this vendor CAN hurt you — their access and the sensitivity of the data they touch. This is inherent risk and sets the ceiling: a vendor with privileged access to regulated data cannot be low-risk on controls alone.
Level of access this vendor has to your systems or data.
Most sensitive data classification the vendor stores or processes.
Certifications & independent assurance · weight 16 / 100
Has anyone outside the vendor verified their security? A current SOC 2 Type II or ISO 27001 report and a recent independent penetration test are worth more than any self-attestation.
Current independent security attestation.
Independent penetration test within the last 12 months.
Data protection & encryption · weight 12 / 100
Whether your data is protected at rest and in transit, and how keys are managed. Gaps here turn any other weakness into direct data exposure.
Encryption of your data at rest.
Encryption of data in transit.
Identity & access control · weight 12 / 100
How the vendor authenticates its own staff and your users. Weak authentication or shared accounts are a leading path into a breach.
MFA for anyone (vendor staff or your users) accessing your data.
SSO, least privilege and timely deprovisioning for your tenant.
Subprocessors & fourth parties · weight 10 / 100
Who else touches your data behind the vendor, and whether the vendor holds them to the same bar. A supplier is only as safe as its own suppliers.
Subprocessors / fourth parties disclosed.
Security obligations flowed down to subprocessors.
Breach history & transparency · weight 8 / 100
Past incidents and, more importantly, how the vendor handled and disclosed them. A clean history is good; an honestly disclosed and well-handled one is reassuring; concealment is a red flag.
Known security breaches in the last 3 years and how they were handled.
Incident response & notification SLA · weight 12 / 100
Whether the vendor can respond to an incident and whether they are contractually bound to tell YOU within a defined window. Without an SLA you may learn of a breach far too late.
Documented, tested incident-response plan.
Contractual breach-notification SLA to you.
Business continuity & resilience · weight 7 / 100
Whether the vendor can keep running, and recover, after a disruption. Tested backups and defined RTO/RPO are the difference between a blip and an outage you inherit.
Business continuity / disaster recovery with tested backups and defined RTO/RPO.
Right to audit & contractual protections · weight 5 / 100
Whether you can verify the vendor over time rather than trusting once at onboarding. A right to audit or to current attestations keeps assurance alive through the term.
Right to audit or to receive current assurance evidence during the term.
General guidance, not legal or procurement advice. The domain and item weights and the answer values are PlayCISO's own transparent rubric for a structured conversation — not a measurement, certification, or guarantee of outcome, and not based on any real-world average or benchmark figure. Answer options map to fixed values between 0 (highest risk) and 1 (lowest risk); each domain score is the weighted average of its items, and the overall assurance score is the domain-weighted average scaled to 0-100, so the best option on every item gives 100 and the worst gives 0. Unanswered questions count as 0, because an unknown is itself a risk. The tool performs no scan and makes no network calls — it runs entirely in your browser, and nothing you type leaves your device unless you download or copy it.
What this tool is
- A free, in-browser third-party risk management (TPRM) tool with two modes: score a vendor you are evaluating, or generate a security questionnaire to send a vendor.
- Scoring runs a weighted questionnaire across nine domains — data access and classification, certifications (SOC 2 / ISO 27001), encryption, MFA/SSO, subprocessors, breach history, incident response and notification SLA, business continuity, and right to audit.
- You get a 0-100 assurance score (higher means lower risk), a Critical / High / Medium / Low risk tier, the prioritised gaps to push on first, and a list of recommended contract clauses to negotiate.
- The questionnaire generator emits a SIG-lite-style question set grouped by domain as copyable and downloadable Markdown you can paste into an email or your GRC tool.
- Every weight is published and transparent — it is PlayCISO’s own rubric, not an industry average, and no figures are fabricated. The tool makes zero network calls; everything runs in your browser.
What is third-party risk management?
Third-party risk management (TPRM) — also called vendor risk management or supplier risk management — is how you identify and control the risk that the companies you rely on bring into your own organisation. When a vendor has access to your data, your systems or your customers, their security becomes part of yours: a breach, outage or misconfiguration at a supplier can expose your data or halt your operations exactly as a failure of your own would. Regulators and frameworks increasingly expect you to be able to show you assessed and are monitoring your critical suppliers, not just that you trusted them.
TPRM runs across the whole relationship: tier vendors by how much risk they carry, assess them with a questionnaire and supporting evidence before and during the engagement, contract the right security and privacy obligations, and monitor and re-assess over time. This tool covers the assessment and contracting steps.
How to tier vendors
Tier by inherent risk — the damage a failure at that vendor could cause — not by spend. The two strongest signals are access and data sensitivity:
- Access level. No access to your systems is low risk; read-only to a narrow data set is higher; broad read access higher still; and write, privileged or admin access is the highest — that vendor can change or destroy, not just read.
- Data classification. Public or no data is low risk; internal-only is higher; confidential business data higher still; and regulated personal data (PII, PHI, PCI) is the highest, because a breach triggers legal notification duties and real harm to people.
- Tier drives depth. Critical and High vendors warrant evidence review (SOC 2 Type II, pen-test summaries), strong contract terms and periodic re-assessment; Low-tier vendors may need only a lightweight questionnaire. This tool folds access and classification into the score, so a vendor that handles sensitive data cannot look low-risk on controls alone.
What a security questionnaire covers
A security questionnaire asks a vendor to describe their posture so you can assess it before you trust them. Standardised formats include the SIG (Standardized Information Gathering) questionnaire and the CAIQ. Whatever the format, the domains are broadly the same — and this tool’s generator emits a SIG-lite set across them:
- Company & scope — what the service does and exactly what data it touches.
- Certifications & assurance — SOC 2 Type II, ISO 27001, recent independent penetration tests.
- Data protection — encryption at rest and in transit, key management, data residency.
- Identity & access — MFA, SSO, least privilege, and timely offboarding.
- Subprocessors — who else touches the data, and whether obligations flow down to them.
- Incident response — a tested IR plan and a contractual breach-notification SLA.
- Continuity & governance — BC/DR with RTO/RPO, plus privacy and your right to audit.
General guidance, not legal or procurement advice. The weights are PlayCISO's own transparent rubric for a structured conversation — not a measurement, certification, or claim about any industry average. The suggested contract clauses are starting points for your own legal and procurement teams to adapt to your jurisdiction, risk appetite and the specific engagement before anything is signed.
Frequently asked questions
What is third-party risk management (TPRM)?
Third-party risk management is the practice of identifying, assessing and controlling the risk that vendors, suppliers and service providers introduce to your organisation. Because a third party often has access to your data, your systems or your customers, their security weaknesses become your security weaknesses — a breach at a vendor can expose your data just as directly as a breach of your own network. TPRM covers the whole lifecycle: tiering vendors by how much risk they carry, assessing them (often with a security questionnaire and evidence like a SOC 2 report) before and during the relationship, writing security and privacy obligations into the contract, and monitoring and re-assessing over time. This tool helps with the assessment and contracting steps: it scores a vendor against a transparent rubric and suggests clauses to negotiate, or it generates a questionnaire you can send.
How should I tier my vendors?
Tier vendors by inherent risk — how much damage a failure or breach at that vendor could do — not by how much you spend with them. The two biggest drivers are access and data sensitivity: a vendor with privileged or write access to your systems, or one that stores regulated personal data (PII, PHI, PCI), is inherently higher risk than one that handles only public data with no system access. A common model is three or four tiers (for example Critical, High, Medium, Low), where Critical vendors get the deepest due diligence (evidence review, pen-test summaries, annual re-assessment, strong contract terms) and Low-tier vendors get a lightweight questionnaire or none at all. This tool folds access level and data classification into the score and derives a risk tier, so a vendor that touches a lot of sensitive data cannot score as low-risk on controls alone.
What does a vendor security questionnaire cover?
A security questionnaire asks a vendor to describe their security and privacy posture so you can assess it before trusting them. Common standardised formats include the SIG (Standardized Information Gathering) questionnaire and CAIQ (Consensus Assessments Initiative Questionnaire). Typical domains are: company and scope (what the service is and what data it touches); independent certifications and assurance (SOC 2 Type II, ISO 27001, recent penetration tests); data protection (encryption at rest and in transit, key management, data residency); identity and access management (MFA, SSO, least privilege, offboarding); subprocessors and fourth parties (who else touches the data and whether obligations flow down); incident response and breach notification (a tested IR plan and a contractual notification SLA); business continuity and disaster recovery (RTO/RPO, tested backups); and governance, privacy and the customer’s right to audit. This tool’s generator emits a SIG-lite set across those domains.
How is the 0-100 score calculated, and what do the risk tiers mean?
Each question has fixed answer options with a published value between 0 (worst, highest risk) and 1 (best, lowest risk). Within a domain, each question carries a relative weight; the domain score is the weighted average of its answered questions. The overall assurance score is the domain-weighted average of all nine domains, scaled to 0-100, so answering every question with the best option gives 100 and every question with the worst option gives 0. A higher score means lower risk. The risk tier is derived from that score: Low at 80 and above, Medium from 60, High from 40, and Critical below 40. Unanswered questions count as 0, because unknown is itself a risk in vendor assessment. All weights are shown in the tool — they are PlayCISO’s own transparent rubric for a structured conversation, not a measurement, certification or claim about any real-world average.
Is my data sent anywhere, and is this legal or procurement advice?
No data is sent anywhere. The tool runs entirely in your browser and makes zero network calls — your answers, the vendor name and everything you type stay on your device unless you choose to download or copy a report. There are no fabricated statistics and no external lookups. And no, this is general educational guidance, not legal, procurement or compliance advice. The recommended contract clauses are starting points for a conversation with your own legal and procurement teams, who should adapt them to your jurisdiction, your risk appetite and the specific engagement before anything is signed.