Vendor & Third-Party Risk Assessment

Your data is only as safe as the vendors that store, process or access it, and regulators and auditors expect you to prove you oversee them. We assess your critical vendors and help you build a practical third-party risk management program that meets GLBA, HIPAA, SOC 2 and ISO 27001 expectations without burying your team in paperwork. It is one of our risk assessments.

What we deliver

Vendor inventory and tiering

We identify every vendor with access to your data or systems and rank them by risk, so you spend effort where it matters: on the vendors that hold sensitive data or could take you offline.

Vendor security reviews

Review of SOC 2 reports, ISO 27001 certificates and penetration test letters, including exceptions and complementary user entity controls
Security questionnaires based on recognized standards such as the SIG or CSA CAIQ
Follow-up on gaps and documented risk decisions

Contracts and requirements

We help you define the security clauses your contracts should include, such as breach notification timelines, right to audit, data handling and, for healthcare, Business Associate Agreements.

Program design and ongoing monitoring

For organizations building a program, we write the policy and procedures, set review frequencies by tier, and can run vendor reviews for you on an ongoing basis.

How Our Vendor Risk Assessment Works

Discovery

We gather your vendor list from contracts, accounts payable and IT, and identify which vendors handle sensitive data or critical services.

Tiering

We rank vendors by data sensitivity, access and business impact, and agree on the level of review each tier needs.

Assessment

We review vendor evidence and questionnaires, follow up on gaps and document each vendor's risk.

Reporting

You receive a vendor risk register, findings for high-risk vendors and recommendations for contracts and remediation.

Ongoing Program

We help you put a repeatable process in place, or run periodic reviews for you, so vendor oversight stays current for auditors and regulators.

Know Who Holds Your Data

Schedule a call to assess your critical vendors or build a third-party risk management program.

Get a Quote

Tell us what you need and a senior consultant will reply within one business day with next steps or a quote. Prefer to talk? Book a call.

Name

Work email

Company

Phone

What do you need?

Tell us a little about it

Frequently Asked Questions

Which regulations require vendor risk management?

Many do. The FTC Safeguards Rule under GLBA requires overseeing service providers, HIPAA requires Business Associate Agreements, SOC 2 expects vendor risk to be managed, ISO 27001 includes supplier relationship controls, and many states and industry regulators have their own requirements.

Is a vendor's SOC 2 report enough?

It is a strong starting point, but only if someone reads it: the scope, the period, any exceptions and the controls the vendor expects you to operate. We review those details and follow up where the report does not cover what you rely on.

Can you run vendor reviews for us on an ongoing basis?

Yes. Many clients ask us to run reviews of new and existing high-risk vendors throughout the year as part of a vCISO or compliance engagement.

How long does a vendor risk assessment take?

An initial inventory and review of critical vendors usually takes a few weeks, depending on the number of vendors and how quickly they respond.

How much does a vendor risk assessment cost?

Pricing depends on the number of vendors and whether you need a one-time review or an ongoing program. We provide a fixed quote after a free scoping call.