Comprehensive Vendor Risk Assessment Framework

Third-Party SaaS Provider Evaluation for Fortune 500 Organizations

---

EXECUTIVE SUMMARY

This framework establishes a structured, repeatable methodology for evaluating third-party Software-as-a-Service (SaaS) providers. It encompasses inherent risk classification, due diligence requirements, contractual provisions, and ongoing monitoring protocols designed to protect organizational assets, ensure regulatory compliance, and maintain operational resilience.

---

PART I: FRAMEWORK FOUNDATIONS

1.1 Governance Structure

┌─────────────────────────────────────────────────────────────────┐
│                    GOVERNANCE HIERARCHY                          │
├─────────────────────────────────────────────────────────────────┤
│  Board Risk Committee                                           │
│       │                                                         │
│  Chief Risk Officer (CRO)                                       │
│       │                                                         │
│  ┌────┴────────────────────────────────────┐                   │
│  CISO          CPO          CLO          CFO                    │
│  (Security)  (Privacy)   (Legal)     (Finance)                 │
│       │          │           │            │                     │
│       └──────────┴───────────┴────────────┘                    │
│                        │                                        │
│              Vendor Risk Management Team                        │
│                        │                                        │
│         ┌──────────────┼──────────────┐                        │
│    Business Unit    IT/Ops      Procurement                     │
│    Stakeholders    Owners        Team                           │
└─────────────────────────────────────────────────────────────────┘

1.2 Framework Scope and Applicability

Criteria	Threshold	Assessment Required
Data sensitivity	Any PII, PHI, financial data	Full assessment
Annual contract value	≥ $50,000	Full assessment
System integration	Any API/system connection	Full assessment
Data volume	>1,000 records	Full assessment
Operational dependency	Mission-critical function	Enhanced assessment
Low-risk SaaS	Productivity tools, no data sharing	Abbreviated assessment

1.3 Core Principles

• Defense in Depth: Multiple control layers across vendor relationships
• Risk Proportionality: Assessment rigor scales with risk exposure
• Continuous Monitoring: Point-in-time assessments supplemented by ongoing oversight
• Shared Responsibility Clarity: Explicit delineation of organizational vs. vendor obligations
• Regulatory Alignment: Consistent with GDPR, CCPA, SOX, HIPAA, PCI-DSS, and sector-specific requirements

---

PART II: RISK CLASSIFICATION AND TIERING

2.1 Inherent Risk Scoring Matrix

Data Risk Scoring

DATA SENSITIVITY SCORE (0-40 points)
─────────────────────────────────────────────────────────────────

Data Category                              Points
─────────────────────────────────────────────────────────────────
Personal Identifiable Information (PII)      30
Protected Health Information (PHI)           40
Payment Card Data (PCI)                      40
Financial Records (SOX scope)                35
Intellectual Property / Trade Secrets        35
Employee Data                                25
Aggregate/Anonymized Data                    10
Publicly Available Information                5
No Organizational Data Shared                 0

MODIFIERS
─────────────────────────────────────────────────────────────────
Volume: >1M records                        +10
Volume: 100K–1M records                    +5
Cross-border data transfer                 +5
Special category data (GDPR Art. 9)        +10
Children's data (COPPA)                    +10

Operational Risk Scoring

OPERATIONAL DEPENDENCY SCORE (0-30 points)
─────────────────────────────────────────────────────────────────

Dependency Level                           Points
─────────────────────────────────────────────────────────────────
Mission-critical (outage = revenue loss)     30
Business-critical (outage = productivity     20
  loss >1,000 employee-hours/day)
Supporting (outage = workaround available)   10
Non-critical (outage = minor inconvenience)   5

MODIFIERS
─────────────────────────────────────────────────────────────────
No documented SLA                          +5
Single vendor (no alternative)             +5
Integration with >10 internal systems      +5
Real-time processing dependency            +5

Access Risk Scoring

ACCESS AND PRIVILEGE SCORE (0-30 points)
─────────────────────────────────────────────────────────────────

Access Level                               Points
─────────────────────────────────────────────────────────────────
Admin/privileged access to core systems     30
Read/write access to sensitive data         20
Read-only access to sensitive data          15
Access to non-sensitive systems             10
No system access (data only)                 5
No access of any kind                        0

MODIFIERS
─────────────────────────────────────────────────────────────────
Remote access capability                   +5
Shared credentials in use                  +8
No MFA requirement                         +5
Physical facility access                   +5

2.2 Risk Tier Classification

TOTAL INHERENT RISK SCORE → TIER ASSIGNMENT
─────────────────────────────────────────────────────────────────

Score Range    Tier    Label         Assessment Cycle
─────────────────────────────────────────────────────────────────
75–100         T1      Critical      Annual + Event-triggered
50–74          T2      High          Annual
25–49          T3      Medium        Biennial
0–24           T4      Low           Triennial or Registration only

TIER ASSESSMENT REQUIREMENTS
─────────────────────────────────────────────────────────────────
                          T1    T2    T3    T4
─────────────────────────────────────────────────────────────────
Security questionnaire    ●     ●     ●     ○
SOC 2 Type II review      ●     ●     ○     ○
Penetration test review   ●     ●     ○     ○
On-site assessment        ●     ○     ○     ○
Financial viability       ●     ●     ○     ○
Reference checks          ●     ●     ●     ○
Legal/contract review     ●     ●     ●     ●
Insurance verification    ●     ●     ●     ○

● = Required   ○ = Optional/Discretionary

---

PART III: DUE DILIGENCE ASSESSMENT DOMAINS

3.1 Domain 1: Information Security Controls

3.1.1 Security Program Governance

Control Area	Requirement	Evidence	Tier Applicability
Information Security Policy	Board/executive-approved, reviewed annually	Policy document + approval record	T1, T2
CISO/Security Leadership	Dedicated security executive	Org chart, LinkedIn validation	T1
Security awareness training	Annual mandatory training with completion tracking	Training records, LMS screenshots	T1, T2, T3
Security incident response plan	Documented IRP tested within 12 months	IRP document + tabletop results	T1, T2
Vendor's vendor management	Fourth-party risk program in place	Program documentation	T1

3.1.2 Security Questionnaire — Core Questions

SECTION A: ACCESS CONTROL (Weight: 15%)
─────────────────────────────────────────────────────────────────

A1. Identity and Access Management
□ Is role-based access control (RBAC) implemented?
□ Is the principle of least privilege enforced?
□ Is privileged access management (PAM) solution in use?
□ Are access rights reviewed on what frequency? _______________
□ Is multi-factor authentication (MFA) required for:
  □ All employees?  □ Admin accounts?  □ Remote access?
□ Is single sign-on (SSO) supported for customer tenants?
□ Are shared/generic accounts prohibited?
□ How are terminated employees' access revoked? (SLA: ___ hours)

SCORING: Yes = 1 point per checkbox; Partial = 0.5 points
Minimum passing score: 80%


SECTION B: DATA PROTECTION (Weight: 25%)
─────────────────────────────────────────────────────────────────

B1. Encryption
□ Data encrypted at rest (specify algorithm): _______________
□ Data encrypted in transit (TLS version): _______________
□ Database-level encryption implemented?
□ Customer-managed encryption keys (CMEK) available?
□ Key management solution (HSM or KMS): _______________
□ Key rotation frequency: _______________

B2. Data Classification
□ Formal data classification policy exists?
□ Customer data segregated by classification level?
□ Data loss prevention (DLP) tools deployed?
□ Data masking/tokenization used in non-production environments?

B3. Data Inventory
□ Comprehensive data inventory/catalog maintained?
□ Data flows documented including sub-processors?
□ Retention and deletion schedules documented?


SECTION C: NETWORK AND INFRASTRUCTURE (Weight: 15%)
─────────────────────────────────────────────────────────────────

C1. Network Security
□ Network segmentation between customer tenants?
□ Web Application Firewall (WAF) deployed?
□ Intrusion Detection/Prevention Systems (IDS/IPS) active?
□ DDoS mitigation controls in place?
□ Network traffic monitoring and logging?

C2. Vulnerability Management
□ Vulnerability scanning frequency: _______________
□ Critical vulnerability patching SLA: _______________
□ High vulnerability patching SLA: _______________
□ External penetration test frequency: _______________
□ Bug bounty or responsible disclosure program?

C3. Cloud Infrastructure
□ Cloud providers used: _______________
□ CSP security configuration benchmarks followed (CIS, etc.)?
□ Infrastructure as Code (IaC) security scanning?
□ Container security controls implemented?


SECTION D: MONITORING AND INCIDENT RESPONSE (Weight: 20%)
─────────────────────────────────────────────────────────────────

D1. Security Monitoring
□ Security Information and Event Management (SIEM) deployed?
□ 24/7 security operations monitoring?
□ Log retention period: _______________
□ Anomaly/behavioral detection capabilities?

D2. Incident Response
□ Documented and tested incident response plan?
□ Incident notification SLA to customers: _______________
□ Regulatory notification obligations met?
□ Post-incident root cause analysis provided to customers?
□ Cyber incident insurance coverage amount: _______________

D3. Threat Intelligence
□ Threat intelligence feeds subscribed to?
□ ISAC membership relevant to industry?
□ Threat hunting activities performed?


SECTION E: PHYSICAL AND ENVIRONMENTAL SECURITY (Weight: 10%)
─────────────────────────────────────────────────────────────────

E1. Data Center Security
□ SOC 2 or ISO 27001 certified facilities?
□ Biometric/multi-factor physical access controls?
□ 24/7 physical security monitoring?
□ Environmental controls (fire suppression, HVAC, UPS)?
□ Visitor access logs maintained?

E2. Employee Security
□ Pre-employment background checks performed?
□ Confidentiality/NDA agreements required?
□ Security clearances (if applicable)?
□ Insider threat program in place?


SECTION F: SECURE DEVELOPMENT (Weight: 15%)
─────────────────────────────────────────────────────────────────

F1. SDLC Security
□ Secure coding standards documented and followed?
□ Static Application Security Testing (SAST) in CI/CD?
□ Dynamic Application Security Testing (DAST) performed?
□ Software Composition Analysis (SCA) for open-source?
□ Code review requirements (peer + security)?
□ Security testing before each major release?

F2. Change Management
□ Formal change management process?
□ Security review gate in change process?
□ Rollback capability for failed changes?

3.1.3 Security Scoring Rubric

SECURITY DOMAIN SCORING
─────────────────────────────────────────────────────────────────

Domain          Weight    Score (0-100)    Weighted Score
─────────────────────────────────────────────────────────────────
Access Control    15%         ___              ___
Data Protection   25%         ___              ___
Network/Infra     15%         ___              ___
Monitoring/IR     20%         ___              ___
Physical Security 10%         ___              ___
Secure Dev        15%         ___              ___
─────────────────────────────────────────────────────────────────
TOTAL SECURITY SCORE                           ___/100

PASS THRESHOLDS
─────────────────────────────────────────────────────────────────
T1 (Critical):  ≥ 85 points — Proceed
                75–84 points — Conditional approval with remediation plan
                < 75 points — Reject or defer pending remediation

T2 (High):      ≥ 75 points — Proceed
                65–74 points — Conditional approval
                < 65 points — Reject

T3 (Medium):    ≥ 65 points — Proceed
                < 65 points — Reject

---

3.2 Domain 2: SOC 2 Compliance Assessment

3.2.1 SOC 2 Report Evaluation Framework

SOC 2 REPORT ACCEPTANCE CRITERIA
─────────────────────────────────────────────────────────────────

REPORT TYPE REQUIREMENTS BY TIER
─────────────────────────────────────────────────────────────────
Tier    Minimum Acceptable Report
─────────────────────────────────────────────────────────────────
T1      SOC 2 Type II (12-month period, issued within 6 months)
T2      SOC 2 Type II (issued within 12 months)
T3      SOC 2 Type I or Type II (issued within 18 months)
T4      SOC 2 Type I or equivalent certification

TRUST SERVICE CRITERIA REQUIREMENTS
─────────────────────────────────────────────────────────────────
                              T1    T2    T3    T4
─────────────────────────────────────────────────────────────────
Security (CC)                 ●     ●     ●     ●
Availability (A)              ●     ●     ○     ○
Processing Integrity (PI)     *     *     ○     ○
Confidentiality (C)           ●     ●     ○     ○
Privacy (P)                   *     *     ○     ○

● = Required
* = Required if applicable to service
○ = Preferred but not required

3.2.2 SOC 2 Report Deep-Dive Checklist

STEP 1: REPORT AUTHENTICITY AND CURRENCY
─────────────────────────────────────────────────────────────────
□ Report obtained directly from vendor (not marketing summary)
□ CPA firm name and license verified (AICPA directory)
□ Report period end date within acceptable threshold
□ Bridge letter obtained if report >6 months old (T1/T2)
□ Bridge letter covers material changes and exceptions
□ Report issued by independent auditor (not affiliated entity)


STEP 2: AUDITOR'S OPINION ANALYSIS
─────────────────────────────────────────────────────────────────
Opinion Type                    Acceptability
─────────────────────────────────────────────────────────────────
Unqualified                     ✓ Accept
Qualified                       ✗ Reject unless mitigated
Adverse                         ✗ Reject
Disclaimer                      ✗ Reject

Key phrases to identify:
□ "In our opinion, the description fairly presents..."
□ "Controls were suitably designed..."     [Type I/II]
□ "Controls operated effectively..."       [Type II only]


STEP 3: SCOPE ANALYSIS
─────────────────────────────────────────────────────────────────
□ Scope covers the specific services we are procuring
□ All material systems and infrastructure included in scope
□ Sub-processors/fourth parties addressed
□ Carve-outs documented and risk assessed:
  - What is carved out? _______________
  - Why? _______________
  - Our compensating controls? _______________

□ Complementary User Entity Controls (CUECs) identified:
  List of CUECs: _______________
  Verification that we have implemented each CUEC: _______________


STEP 4: EXCEPTION ANALYSIS
─────────────────────────────────────────────────────────────────
For each exception identified:

Exception #     Description              Severity    Our Impact
─────────────────────────────────────────────────────────────────
1               _______________          H/M/L       _______________
2               _______________          H/M/L       _______________
3               _______________          H/M/L       _______________

Exception Severity Framework:
HIGH:   Exceptions in access control, encryption, or incident 
        response — requires written remediation plan with dates
MEDIUM: Exceptions in monitoring or change management — 
        requires acknowledgment and compensating controls
LOW:    Process/documentation exceptions — note and track

Maximum Acceptable Exceptions:
T1: 0 High, ≤2 Medium, ≤5 Low
T2: 0 High, ≤3 Medium, ≤8 Low
T3: ≤1 High with remediation plan, ≤5 Medium


STEP 5: CONTROL MAPPING TO OUR REQUIREMENTS
─────────────────────────────────────────────────────────────────
Map vendor SOC 2 controls to our control framework:

Our Requirement         SOC 2 Control Ref.    Coverage    Gap
─────────────────────────────────────────────────────────────────
MFA for all access      CC6.1, CC6.3          Full/Partial ___
Encryption at rest      CC6.7                 Full/Partial ___
Incident notification   CC7.4, CC7.5          Full/Partial ___
Vulnerability mgmt      CC7.1                 Full/Partial ___
Change management       CC8.1                 Full/Partial ___
Data deletion           CC6.5                 Full/Partial ___

3.2.3 Alternative Certifications Equivalency

ACCEPTABLE ALTERNATIVE CERTIFICATIONS
─────────────────────────────────────────────────────────────────

Certification          Acceptable For    Equivalency Notes
─────────────────────────────────────────────────────────────────
ISO 27001              T2, T3, T4        Requires controls
                                         mapping analysis

ISO 27017 + 27018      T2, T3            Cloud-specific; strong
                                         privacy provisions

PCI DSS (Level 1)      T2, T3            Payment data only;
                                         not full security eq.

FedRAMP Authorized     T1, T2            Strong; exceeds SOC 2
                                         for gov. requirements

HITRUST CSF r2         T1, T2            Healthcare context;
                                         strong equivalency

CSA STAR Level 2       T2, T3            Cloud-specific;
                                         supplementary

IRAP (Australia)       T2, T3            Region-specific use
ENS (Spain)            T2, T3            Region-specific use

---

3.3 Domain 3: Data Residency and Privacy

3.3.1 Data Residency Requirements Matrix

DATA RESIDENCY REQUIREMENT MATRIX
─────────────────────────────────────────────────────────────────

Data Category         Residency Requirement    Acceptable Regions
─────────────────────────────────────────────────────────────────
US Customer PII       US territory preferred;  US (all regions)
                      EU adequacy accepted      EU (with SCCs)

EU Citizen Data       EU/EEA required          EU Member States
(GDPR)                (GDPR Chapter V)          EEA countries
                                               UK (with addendum)
                                               Adequacy countries*

Healthcare Data       US required              US only
(HIPAA)               

Payment Card Data     PCI DSS zone             Approved PCI regions
(PCI)                 

Financial Records     Jurisdiction-specific    Per regulatory
(SOX/Banking)         retention requirements   guidance

Trade Secrets/IP      Customer-defined         Subject to export
                                               control review

HR/Employee Data      Employee's country       Per local labor law
                      of employment

*Adequacy countries: UK, Canada, Switzerland, Japan, South Korea,
 New Zealand, Israel, Uruguay, Argentina

─────────────────────────────────────────────────────────────────
CROSS-BORDER TRANSFER MECHANISMS (GDPR)
─────────────────────────────────────────────────────────────────

Mechanism              Status      Notes
─────────────────────────────────────────────────────────────────
EU-US Data Privacy     Active      Verify vendor certification
Framework              
Standard Contractual   Active      Verify 2021 SCCs version
Clauses (SCCs)         
Binding Corporate      Active      For intra-group transfers
Rules (BCRs)           
Adequacy Decision      Active      Country-specific
Explicit Consent       Limited     Not scalable for B2B
Art. 49 Derogations    Limited     Case-by-case only

3.3.2 Data Residency Verification Protocol

VERIFICATION STEPS
─────────────────────────────────────────────────────────────────

□ STEP 1: Obtain data flow documentation
  - Complete data flow diagram including all processing locations
  - Identification of all sub-processors and their locations
  - Backup and DR site locations
  - Support/operations team access locations

□ STEP 2: Contractual commitment verification
  - Data Processing Agreement (DPA) executed
  - Specific geographic restrictions contractually bound
  - Sub-processor list current and approved
  - Notification obligation for sub-processor changes (minimum
    30-day advance notice)

□ STEP 3: Technical verification
  - Request IP geolocation confirmation of primary systems
  - Review CDN configuration (edge node locations)
  - Verify backup storage locations
  - Confirm disaster recovery site compliance

□ STEP 4: Sub-processor deep dive
  For each sub-processor (fourth party):
  
  Sub-Processor Name: _______________
  Function: _______________
  Data Accessed: _______________
  Location: _______________
  Transfer Mechanism: _______________
  Their Sub-processors: _______________
  DPA in Place: Yes / No
  SOC 2 or equivalent: Yes / No / N/A

□ STEP 5: Ongoing monitoring
  - Notification mechanism for infrastructure changes
  - Annual confirmation of residency compliance
  - Audit rights for residency verification

3.3.3 Privacy Program Assessment

PRIVACY ASSESSMENT CRITERIA
─────────────────────────────────────────────────────────────────

Area                Question                              Weight
─────────────────────────────────────────────────────────────────
Privacy Program     Dedicated Privacy Officer?              5%
Governance          Privacy program with board oversight?   5%
                    Privacy-by-design methodology?          5%

Data Subject        Mechanism to fulfill DSARs?            10%
Rights              DSAR response SLA (≤30 days GDPR)?     5%
                    Process tested and documented?          5%

Consent             Consent management platform?            5%
Management          Consent records maintained?             5%

Privacy Impact      DPIA process for high-risk processing? 10%
Assessment          DPIAs conducted and documented?         5%

Data Minimization   Minimum necessary data collection?      5%
                    Retention limits enforced technically?  5%

Breach Response     72-hour GDPR notification capability?  10%
                    State law notification compliance?       5%
                    Breach notification procedures tested?  5%

Vendor Privacy      Processor agreement chain complete?     5%
                    Sub-processor due diligence?            5%

─────────────────────────────────────────────────────────────────
MINIMUM SCORE: T1: 85% | T2: 75% | T3: 65%

---

3.4 Domain 4: Business Continuity and Resilience

3.4.1 Business Continuity Program Assessment

BCP EVALUATION FRAMEWORK
─────────────────────────────────────────────────────────────────

SECTION 1: PROGRAM DOCUMENTATION
─────────────────────────────────────────────────────────────────
□ Business Continuity Plan (BCP) documented?
□ Disaster Recovery Plan (DRP) documented?
□ Plans reviewed/updated within last 12 months?
□ Board or executive approval of plans?
□ BCP covers all services in scope for our use?
□ Dependencies and interdependencies documented?

SECTION 2: RECOVERY OBJECTIVES
─────────────────────────────────────────────────────────────────
                            Vendor Claimed    Our Requirement
Service/Component           RTO     RPO       RTO     RPO
─────────────────────────────────────────────────────────────────
Primary application         ___     ___       ___     ___
Database/data storage        ___     ___       ___     ___
Authentication services      ___     ___       ___     ___
API/integration layer        ___     ___       ___     ___
Reporting/analytics          ___     ___       ___     ___
Support/help desk            ___     ___       ___     ___

Recovery Objective Benchmarks by Tier:
T1 Mission-Critical: RTO ≤ 4 hours, RPO ≤ 1 hour
T2 Business-Critical: RTO ≤ 8 hours, RPO ≤ 4 hours
T3 Supporting: RTO ≤ 24 hours, RPO ≤ 8 hours
T4 Non-Critical: RTO ≤ 72 hours, RPO ≤ 24 hours

SECTION 3: INFRASTRUCTURE RESILIENCE
─────────────────────────────────────────────────────────────────
□ Multi-AZ or multi-region deployment?
  Primary region: _______________
  Secondary region: _______________
  Distance between sites: _______________

□ Active-active or active-passive configuration?
□ Automated failover capability?
□ Failover tested frequency: _______________

□ Redundancy specifications:
  Network: _______________
  Power: _______________
  Compute: _______________
  Storage: _______________

SECTION 4: BACKUP AND DATA PROTECTION
─────────────────────────────────────────────────────────────────
□ Backup frequency: _______________
□ Backup types (full/incremental/differential): _______________
□ Backup storage locations: _______________
□ Backup encryption: _______________
□ Backup integrity testing frequency: _______________
□ Last successful restoration test date: _______________
□ Backup retention period: _______________
□ Immutable backup capability: _______________
□ Ransomware protection for backups: _______________

SECTION 5: TESTING AND VALIDATION
─────────────────────────────────────────────────────────────────
Test Type               Frequency    Last Completed    Results
─────────────────────────────────────────────────────────────────
Tabletop exercise       Annual       _______________   Pass/Fail
Component failover      Quarterly    _______________   Pass/Fail
Full DR failover        Annual       _______________   Pass/Fail
Data restoration        Quarterly    _______________   Pass/Fail
Third-party audit       Annual       _______________   Pass/Fail

Test Evidence Required:
□ Test plans and procedures
□ Test results and findings
□ Remediation of findings documented
□ Executive sign-off on results

3.4.2 SLA Requirements Framework

SERVICE LEVEL AGREEMENT REQUIREMENTS
─────────────────────────────────────────────────────────────────

AVAILABILITY SLAs BY TIER
─────────────────────────────────────────────────────────────────
Tier    Min. Availability    Max Monthly Downtime    Measurement
─────────────────────────────────────────────────────────────────
T1      99.99%               4.38 minutes            Monthly
T2      99.95%               21.9 minutes            Monthly
T3      99.9%                43.8 minutes            Monthly
T4      99.5%                3.65 hours              Monthly

Note: Exclude only: (a) scheduled maintenance with ≥72 hours 
notice, (b) customer-caused outages, (c) force majeure events 
with specific definitions

PERFORMANCE SLAs
─────────────────────────────────────────────────────────────────
Metric                  T1 Requirement    T2 Requirement
─────────────────────────────────────────────────────────────────
Page load time          <2 seconds        <3 seconds
API response time       <200ms (P95)      <500ms (P95)
Throughput              As agreed         As agreed
Error rate              <0.1%             <0.5%

SUPPORT SLAs
─────────────────────────────────────────────────────────────────
Priority    Definition              Response    Resolution
─────────────────────────────────────────────────────────────────
P1          System unavailable      15 min      4 hours
P2          Major feature broken    1 hour      8 hours
P3          Feature degraded        4 hours     48 hours
P4          Minor issue             24 hours    Roadmap TBD

FINANCIAL PENALTIES
─────────────────────────────────────────────────────────────────
Downtime Beyond SLA     Service Credit
─────────────────────────────────────────────────────────────────
0–2%                    10% of monthly fee
2–5%                    25% of monthly fee
5–10%                   50% of monthly fee
>10%                    100% of monthly fee + termination right

3.4.3 Concentration and Dependency Risk

CONCENTRATION RISK ASSESSMENT
─────────────────────────────────────────────────────────────────

□ Cloud provider concentration:
  AWS: ___% of vendor infrastructure
  Azure: ___% of vendor infrastructure
  GCP: ___% of vendor infrastructure
  Other: ___% of vendor infrastructure
  
  Risk Flag: >80% with single CSP without multi-cloud roadmap

□ Geographic concentration:
  Single country operations: High Risk
  Single region operations: Medium Risk
  Multi-region operations: Low Risk

□ Operational concentration risks:
  Single datacenter: _______________
  Single ISP/network: _______________
  Key person dependency: _______________
  Single-source critical components: _______________

□ Our concentration risk:
  Vendor as % of function criticality: ___%
  Alternative vendors available: Yes / No / Partial
  Time to migrate if vendor fails: _______________
  Exit cost estimate: $_______________

---

3.5 Domain 5: Financial Viability Assessment

3.5.1 Financial Health Scoring

FINANCIAL VIABILITY ASSESSMENT (T1 and T2 Required)
─────────────────────────────────────────────────────────────────

QUANTITATIVE ASSESSMENT
─────────────────────────────────────────────────────────────────

Metric                      Criterion              Score (0-25)
─────────────────────────────────────────────────────────────────
Revenue Growth              >20% YoY = 25          ___
(or ARR for private)        10-20% = 20
                            0-10% = 15
                            Declining = 5

Cash Runway                 >24 months = 25        ___
(Private companies)         12-24 months = 15
                            6-12 months = 5
                            <6 months = Reject

Profitability               Profitable = 25        ___
(Public companies)          Breakeven = 15
                            <20% burn = 10
                            >20% burn = 5

Customer Retention          >95% NRR = 25          ___
(Net Revenue Retention)     90-95% = 15
                            <90% = 5

─────────────────────────────────────────────────────────────────
MAXIMUM FINANCIAL SCORE: 100 points

QUALITATIVE ASSESSMENT
─────────────────────────────────────────────────────────────────

Comprehensive Vendor Risk Assessment Framework for Third-Party SaaS Providers

Fortune 500 Company

---

1. Framework Overview

This framework establishes a standardized process for evaluating third-party SaaS providers to ensure alignment with organizational security, compliance, and operational resilience requirements. It applies to all SaaS vendors handling confidential data, critical business processes, or integrated systems.

---

2. Risk Assessment Phases

Phase 1: Pre-Assessment Scoping

• Vendor Criticality Tiering:

  • Tier 1 (High Risk): Providers handling PII/PHI, financial data, intellectual property, or mission-critical operations.
  • Tier 2 (Medium Risk): Providers with limited data access or non-critical functions.
  • Tier 3 (Low Risk): Vendors with no data access or operational impact.

• Data Classification:

  • Public, Internal, Confidential, Restricted (based on data sensitivity).

---

3. Core Assessment Domains

3.1 Data Security & Residency Requirements

Data Residency & Sovereignty:

• Geographic Restrictions:
  • Data storage/processing must comply with jurisdictional laws (e.g., GDPR, CCPA, HIPAA).
  • Require explicit mapping of data flows and storage locations.
• Encryption Standards:
  • AES-256 encryption for data at rest; TLS 1.3+ for data in transit.
• Access Controls:
  • Role-based access control (RBAC) with multi-factor authentication (MFA) enforcement.
• Data Retention & Deletion:
  • Contractual clauses for data purging upon contract termination.

Subprocessor Management:

• Vendor must disclose all subprocessors and obtain prior approval for changes.
• Flow-down agreements requiring subprocessors to meet equivalent security standards.

---

3.2 SOC 2 Compliance Criteria

Mandatory Requirements:

• SOC 2 Type II Report:
  • Must cover the Security criterion at minimum; Availability, Confidentiality, Processing Integrity, Privacy as relevant.
  • Report must be less than 12 months old at assessment.
• Independent Audit Review:
  • Validate scope, exceptions, and corrective action plans (CAPs).
• Control Areas Verified:
  • Logical and physical access controls.
  • Change management and system monitoring.
  • Risk mitigation and incident response procedures.

Acceptable Alternatives:

• ISO 27001 certification + penetration testing reports.
• HITRUST CSF for healthcare data.

---

3.3 Business Continuity & Disaster Recovery (BC/DR)

Service Level Agreements (SLAs):

• Uptime Commitment: Minimum 99.9% availability with financial penalties for breaches.
• Recovery Time Objective (RTO): <4 hours for Tier 1 vendors.
• Recovery Point Objective (RPO): <1 hour for critical data.

BC/DR Documentation:

• Require annual BC/DR plan testing with results shared.
• Geographic redundancy: Active-active or hot-site configurations for Tier 1 vendors.
• Incident communication protocols: Escalation timelines <30 minutes.

Exit Strategy:

• Data portability in standard formats (JSON, CSV, etc.).
• Contractual support for transition periods (minimum 60 days).

---

4. Assessment Process

1. Questionnaire Distribution:
   • Use standardized template (e.g., SIG Lite, CAIQ) tailored to vendor tier.
2. Document Review:
   • SOC 2 reports, pen test results, BC/DR plans, insurance certificates.
3. Technical Validation:
   • Independent vulnerability scans (if permitted).
   • Tabletop exercises for incident response.
4. Risk Scoring & Approval:
   • Scorecard evaluating controls (1–5 scale).
   • Risk acceptance requiring CISO/CPO approval for exceptions.

---

5. Continuous Monitoring

• Annual Recertification: Full reassessment for Tier 1 vendors.
• Trigger-Based Reviews:
  • Security incidents, mergers/acquisitions, geographic expansion.
• Performance Metrics:
  • Quarterly SLA adherence reports.
  • Real-time monitoring via API integrations (where feasible).

---

6. Contractual Safeguards

• Data Protection Addendum (DPA): Aligned with GDPR/CCPA requirements.
• Right-to-Audit Clauses: Annual audit rights (onsite or remote).
• Liability & Indemnification: Cybersecurity incident liability coverage (minimum $5M).
• Cyber Insurance: Vendors must maintain coverage matching risk exposure.

---

7. Roles & Responsibilities

• Procurement: Initial vendor screening.
• Information Security: Technical risk assessment.
• Legal/Privacy: Contract and compliance review.
• Business Owner: Operational due diligence.

---

8. Tools & Templates

• Vendor Risk Management (VRM) platform for automation.
• Standardized assessment templates per tier.
• Risk register tracking mitigations and ownership.

---

Approval Authority:

• Tier 1: Chief Information Security Officer (CISO)
• Tier 2: Director of Information Security
• Tier 3: Manager of Vendor Risk

Framework reviewed annually and updated per evolving threat landscape and regulatory changes.