Vendor Risk Assessment Template (Free)
A vendor risk assessment is how you check that a company you rely on will not quietly become your weakest link. This page is a plain-language guide to what a third-party risk assessment is, when to run one, the domains a template should cover, how the standard questionnaires (SIG, CAIQ, NIST) fit, and how to score and tier vendors — plus a free, copy-pasteable template you can take straight into procurement.
Vendor risk assessment in plain words
- A vendor (third-party) risk assessment is a structured review of the security, privacy and resilience of a company you are about to work with, or already rely on — run before you sign, and periodically afterwards, so that their weaknesses do not quietly become yours.
- A good template covers a consistent set of domains: what data the vendor will access and how it is classified, their certifications (SOC 2, ISO 27001), encryption, access control and MFA, their subprocessors, breach history, incident response and breach-notification SLAs, business continuity and disaster recovery, and your right to audit.
- Standard questionnaires already exist — the SIG (Standardized Information Gathering), the Cloud Security Alliance CAIQ, and controls mapped to the NIST frameworks — and are worth naming and reusing rather than reinventing; the template below is a compact, generic starting point you can adapt or map to them.
- Scoring turns answers into a decision: weight the domains by how much they matter for this engagement, score each answer, total to a simple 0-100 assurance figure, then assign a risk tier (for example Critical / High / Medium / Low) that drives what evidence you demand and how often you re-assess.
- Tier your vendors by the risk they carry, not by contract size — a small SaaS tool with access to customer data can warrant more scrutiny than a large supplier that never touches your systems. This page is general guidance, not legal or procurement advice.
What a vendor risk assessment is — and when to run one
A vendor risk assessment (also called a third-party or supplier risk assessment) is a structured review of the security, privacy and resilience of a company you work with or are about to. The premise is simple: when a vendor has access to your data, your systems or your customers, their security posture becomes part of yours. A breach, outage or sloppy practice on their side can hit you as directly as if it happened inside your own walls.
Run one before you sign, as part of procurement, so findings can shape the contract rather than arrive too late to change anything. Then re-assess periodically — on a cadence set by how much risk the vendor carries — and again whenever something material changes: new data shared, a major product change, a merger, a reported breach, or a new subprocessor. The aim is that your level of assurance always matches the level of access you have granted.
The domains a template should cover
Cover a consistent set of domains so every vendor is assessed on the same basis and can be compared like for like. These are the ones a solid template includes:
Data access & classification
What data the vendor will see, store or process, and how sensitive it is. This usually sets the risk tier and how heavily the other domains are weighted.
Certifications & attestations
Independent assurance such as SOC 2 Type II and ISO/IEC 27001. Ask for the report or certificate and check its scope and date, not just that one exists.
Encryption
Encryption of data in transit and at rest, and how keys are managed. A baseline control for any vendor handling your data.
Access control & MFA
Least-privilege access, multi-factor authentication, SSO support, and how access is granted, reviewed and revoked — including when staff leave.
Subprocessors & fourth parties
Who the vendor relies on in turn. Their subprocessors inherit access to your data, so you need the list and a way to be notified of changes.
Breach history & disclosure
Past incidents and how they were handled. The answer matters less than the honesty and the lessons applied; evasiveness is itself a signal.
Incident response & notification SLA
Whether they have a tested incident-response process and, critically, how quickly they are contractually obliged to notify you of a breach.
Business continuity & DR
Resilience of the service: tested backups, disaster recovery, and defined RTO/RPO so you know how long an outage could last and how much data could be lost.
Right to audit
Your contractual right to request evidence, security reviews or an audit during the relationship — the mechanism that keeps the other answers honest over time.
Standard questionnaires: SIG, CAIQ and NIST
You rarely need to invent a questionnaire from scratch. The SIG (Standardized Information Gathering) questionnaire, maintained by Shared Assessments, is an industry-standard set of third-party security questions, with a lighter “SIG Lite” subset for lower-risk vendors. The CAIQ (Consensus Assessments Initiative Questionnaire) from the Cloud Security Alliance is a yes/no questionnaire aligned to the CSA Cloud Controls Matrix and is common for cloud providers — many publish a completed CAIQ in the CSA STAR registry. NIST publishes frameworks and guidance (for example the Cybersecurity Framework and SP 800-161 on supply-chain risk) that give you a control vocabulary to map questions against.
For many organisations a compact internal template — optionally mapped to one of these standards — is enough day to day; reach for a full SIG or CAIQ when a counterparty expects it or the vendor is high-risk. The template below is deliberately generic and can be adapted or cross-referenced to any of them.
The template (copy and paste)
A tiered question list — screen every vendor with Tier 1, add Tier 2 for vendors touching confidential data, and go to Tier 3 for critical or regulated ones. Select the block below and copy it into a doc, a sheet or your GRC tool.
# Vendor Risk Assessment Template
Vendor: __________________________ Assessed by: __________________________
Date: ____________ Service / purpose: __________________________________
Data involved: [ ] Public [ ] Internal [ ] Confidential [ ] Regulated/PII
Scoring per question: 2 = control in place + evidence 1 = stated, no evidence 0 = gap / no
Record the evidence (report, screenshot, policy link) next to each answer.
--------------------------------------------------------------------------
TIER 1 — Screening (every vendor)
--------------------------------------------------------------------------
1. What data of ours will you access, store or process? How is it classified?
2. Where (which regions/countries) is our data stored and processed?
3. Do you hold SOC 2 Type II and/or ISO 27001? (attach report/cert + scope + date)
4. Is our data encrypted in transit and at rest? Which algorithms / key management?
5. Is MFA enforced for all staff and for admin access to our data?
6. How quickly will you notify us of a confirmed or suspected breach? (hours)
7. Have you had a security breach in the last 24 months? What happened?
--------------------------------------------------------------------------
TIER 2 — Standard (vendors touching Confidential data)
--------------------------------------------------------------------------
8. List your subprocessors / fourth parties and how we are told of changes.
9. How is access granted, reviewed and revoked (including on staff departure)?
10. Describe your least-privilege model and separation of production access.
11. Do you run a documented, tested incident-response plan? When last tested?
12. What are your backup, business-continuity and DR arrangements? RTO / RPO?
13. How do you handle secure software development and vulnerability management?
14. How is our data returned or deleted at the end of the contract? Timeline?
--------------------------------------------------------------------------
TIER 3 — Deep dive (Critical / regulated vendors)
--------------------------------------------------------------------------
15. Provide penetration-test summaries from the last 12 months + remediation.
16. Describe logging, monitoring and detection coverage over our data.
17. Do you carry cyber-insurance? Coverage limits and scope?
18. Confirm our contractual right to audit or to receive evidence on request.
19. Map your controls to our required framework (SIG / CAIQ / NIST) if requested.
20. Name the security contact and escalation path for incidents involving us.
--------------------------------------------------------------------------
SCORING
--------------------------------------------------------------------------
Assurance score = (sum of answers / max possible for the tiers used) x 100
Risk tier: >= 85 Low 70-84 Medium 50-69 High < 50 Critical
Decision: [ ] Accept [ ] Accept with remediation [ ] Reject
Required contract clauses: ____________________________________________
Next re-assessment date: ______________
This template is a generic starting point, not a completed assessment, and the tiers and scoring thresholds are a simple default you should adjust to your own risk appetite.
How to score and tier vendors
Scoring turns answers into a decision. Weight the domains by how much they matter for this engagement — data access and encryption usually weigh heavily when sensitive data is involved. Score each answer (a simple scheme: full marks for a satisfactory control with evidence, partial for a stated-but-unevidenced control, zero for a gap), combine into a single 0–100 assurance figure where higher means lower residual risk, then assign a risk tier — for example Critical, High, Medium or Low — from both the score and the inherent risk of what the vendor does.
The tier, not the raw number, drives action: what evidence you require, which contract clauses you insist on, whether you accept, remediate or walk away, and how often you re-assess. The one rule worth repeating: tier by the risk carried, not by the size of the contract — a small SaaS tool with a pipe into your customer data can deserve more scrutiny than a large supplier that never touches your systems.
Run it interactively instead of on paper
If you would rather not score by hand, PlayCISO's free Vendor Risk Scorecard runs this same structure for you: it scores a vendor across the nine domains above, returns a 0–100 assurance score and a Critical/High/Medium/Low tier, lists the prioritised gaps and recommended contract clauses, and can also generate a SIG-lite-style questionnaire as copyable Markdown to send a vendor. It runs entirely in your browser — nothing is uploaded.
Vendor risk is one input to a wider programme. Keep the findings in a risk register so each vendor risk has an owner, a treatment and a review date, and when you are weighing how much residual third-party risk to transfer, the cyber-insurance premium estimator gives a sense of the cost side. The full set of free scanners, scorecards and templates is in the PlayCISO tools index.
Note: this page is general guidance to help you build and run a vendor risk assessment; it is not legal, compliance or procurement advice, and it does not replace your own counsel, your regulatory obligations or a vendor's own attestations. Adapt the domains, questions and scoring thresholds to your organisation and the specific engagement.
Frequently asked questions
What is a vendor risk assessment?
A vendor risk assessment (also called a third-party or supplier risk assessment) is a structured review of the security, privacy and operational resilience of a company you work with or are evaluating. Because a vendor often has access to your data, your systems or your customers, their weaknesses can become your weaknesses — a breach at a vendor can expose your data as directly as a breach of your own network. The assessment typically uses a questionnaire covering domains such as data access, certifications, encryption, access control, subprocessors, breach history, incident response, business continuity and the right to audit, often backed by evidence like a SOC 2 report. It is usually run before you sign a contract and then repeated periodically, with the depth of review scaled to how much risk the vendor carries.
When should I run a third-party risk assessment?
Run one before onboarding any vendor that will access your data, connect to your systems, or deliver a service your business depends on — ideally as part of procurement, before the contract is signed, so findings can shape the terms. After onboarding, re-assess on a cadence set by the vendor’s risk tier (a common pattern is annually for higher-risk vendors and less often for low-risk ones), and also whenever something changes: a new type of data shared, a major product change, a merger or acquisition, a reported breach, or the vendor adding a significant new subprocessor. The goal is that the level of assurance you hold always matches the level of access and dependence you have granted.
What should a vendor risk assessment template include?
A practical template covers a consistent set of domains so vendors can be compared like for like: the data the vendor will access and how it is classified; security certifications and attestations such as SOC 2 Type II and ISO 27001; encryption of data in transit and at rest; access control, including MFA and least-privilege and how access is deprovisioned; the vendor’s own subprocessors and fourth parties; breach history and disclosure; incident response capability and, critically, the breach-notification SLA (how quickly they must tell you); business continuity and disaster recovery, including tested RTO/RPO; and your contractual right to audit or to receive evidence. Each domain should have a small number of clear questions and a place to record the evidence provided and a score. The template on this page follows exactly that structure.
What are SIG, CAIQ and NIST, and do I need them?
They are established, reusable references so you do not have to invent a questionnaire from scratch. The SIG (Standardized Information Gathering) questionnaire, maintained by Shared Assessments, is a large, industry-standard set of third-party security questions with a lighter "SIG Lite" subset for lower-risk vendors. The CAIQ (Consensus Assessments Initiative Questionnaire), from the Cloud Security Alliance, is a yes/no questionnaire aligned to the CSA Cloud Controls Matrix and is common for cloud providers — many publish a completed CAIQ in the CSA STAR registry. NIST publishes frameworks and guidance (for example the Cybersecurity Framework and SP 800-161 on supply-chain risk) that supply a control vocabulary to map questions against. You do not need all of them: for many organisations a compact internal template like the one below, optionally mapped to one of these standards, is enough. Reach for a full SIG or CAIQ when a counterparty expects it or the vendor is high-risk.
How do I score and tier vendors?
Scoring converts questionnaire answers into a decision. First weight the domains by how much they matter for this specific engagement — data access and encryption usually weigh heavily when sensitive data is involved. Score each answer (a simple scheme is full marks for a satisfactory control with evidence, partial for a stated but unevidenced control, zero for a gap), combine the weighted scores into a single figure such as 0-100, and read it as an assurance level where higher means lower residual risk. Then assign a risk tier — for example Critical, High, Medium or Low — based on both the score and the inherent risk of what the vendor does. The tier, not the raw number, should drive action: what evidence you require, which contract clauses you insist on, whether you accept, remediate or walk away, and how often you re-assess. Tier by risk carried, not by spend.