Comprehensive Vendor Risk Assessment Framework

Third-Party SaaS Provider Evaluation System

---

Table of Contents

1. Framework Overview & Governance
2. Risk Tiering & Classification
3. Security Questionnaire Templates
4. Compliance Scoring Criteria
5. Assessment Workflow
6. Escalation Procedures
7. Ongoing Monitoring
8. Appendices & Reference Materials

---

1. Framework Overview & Governance

1.1 Purpose & Scope

This framework establishes a standardized, repeatable process for evaluating security, compliance, and operational risks posed by third-party SaaS vendors before and during engagement. It applies to:

• All new SaaS vendor engagements regardless of contract value
• Existing vendor renewals on an annual cycle
• Material changes to existing vendor scope or data access
• Acquired companies whose vendor relationships are inherited

Out of scope: Internal tools built on licensed platforms, open-source libraries (covered separately by Software Composition Analysis), and hardware procurement.

---

1.2 Framework Objectives

Objective	Metric
Identify vendor risks before contract execution	100% of vendors assessed prior to onboarding
Standardize risk scoring across procurement	< 15% variance in scores for identical vendor profiles
Reduce vendor-related security incidents	Year-over-year incident reduction target: 20%
Maintain regulatory compliance evidence	Audit-ready documentation within 24 hours
Enforce contract protections consistently	100% of Tier 1/2 vendors have signed security addenda

---

1.3 Roles & Responsibilities

Role	Responsibility	Authority
Procurement Lead	Initiates assessment, owns vendor relationship	Approve Tier 3 vendors independently
Information Security (IS)	Conducts technical review, scores questionnaire	Approve/reject Tier 1/2 vendors
Legal/Compliance	Reviews contractual terms, regulatory requirements	Block engagement if legal risk unmitigated
Data Privacy Officer (DPO)	Reviews PII/data handling practices	Mandate DPA execution, block if non-compliant
Business Owner	Defines requirements, accepts residual risk	Accept risk with IS written approval only
CISO	Final authority on high-risk vendors	Override or escalate to executive team
Executive Sponsor	Business decision on critical vendor blocks	Board-level escalation for strategic vendors

---

1.4 Framework Governance

┌─────────────────────────────────────────────────────────┐
│                  GOVERNANCE STRUCTURE                     │
├─────────────────────────────────────────────────────────┤
│                                                          │
│  Quarterly Review: IS + Procurement + Legal + DPO        │
│  ├── Review framework effectiveness                      │
│  ├── Update questionnaire for emerging threats           │
│  ├── Calibrate scoring thresholds                        │
│  └── Report on vendor risk portfolio to CISO             │
│                                                          │
│  Annual Review: CISO + Executive Team                    │
│  ├── Framework strategic alignment                       │
│  ├── Regulatory landscape changes                        │
│  └── Resource adequacy assessment                        │
│                                                          │
└─────────────────────────────────────────────────────────┘

---

2. Risk Tiering & Classification

2.1 Vendor Tier Determination Matrix

Complete this matrix at intake to determine the appropriate assessment depth.

Step 1: Data Sensitivity Score

Data Type Involved	Points
No company data (zero-data tools)	0
Non-sensitive internal data only	1
Employee PII (names, email, job titles)	3
Customer PII (names, addresses, contacts)	5
Financial data (invoices, payment info)	6
Sensitive HR data (compensation, performance, health)	7
Customer financial or payment card data	8
Protected Health Information (PHI)	9
Regulated data (government, defense, classified)	10

Step 2: Access Level Score

Access Type	Points
Public-facing only, no data ingestion	0
Read-only access to non-sensitive data	1
Read/write to internal systems (non-sensitive)	3
Read/write to sensitive data	5
Administrative or privileged access	7
Network/infrastructure integration	8
Source code or IP access	9

Step 3: Business Criticality Score

Business Impact if Vendor Unavailable	Points
Minimal – workaround available within hours	1
Low – workaround within 24–48 hours	2
Moderate – significant productivity impact	3
High – core business process disruption	5
Critical – revenue-generating system failure	7
Mission-critical – safety or regulatory reporting	10

---

2.2 Tier Assignment

Total Score = Data Sensitivity + Access Level + Business Criticality

Total Score	Tier	Assessment Level	Timeline
0–5	Tier 3: Low Risk	Abbreviated questionnaire	5 business days
6–12	Tier 2: Moderate Risk	Standard questionnaire	10 business days
13–20	Tier 1: High Risk	Full questionnaire + evidence review	20 business days
21+	Tier 0: Critical Risk	Full questionnaire + on-site/virtual audit	30+ business days

⚠️ Override Rule: Any vendor handling PHI, payment card data, or with administrative access to production systems is automatically elevated to Tier 1 minimum, regardless of composite score.

---

2.3 Tier Profiles

TIER 0: CRITICAL                    TIER 1: HIGH RISK
─────────────────                   ─────────────────
• Core business infrastructure      • Significant data handling
• PHI + financial data combined     • Customer PII at scale
• Regulatory reporting systems      • Internal system integration
• Direct revenue impact             • HR or financial systems
• Requires executive sign-off       • Requires CISO approval
• Bi-annual reassessment            • Annual reassessment

TIER 2: MODERATE RISK               TIER 3: LOW RISK
─────────────────────               ────────────────
• Employee data handling            • No sensitive data
• Productivity tools with SSO       • Public-facing tools only
• Limited integration depth         • Self-contained SaaS
• Requires IS approval              • Procurement approval only
• Annual reassessment               • Bi-annual reassessment

---

3. Security Questionnaire Templates

3.1 Module Structure

All questionnaires are modular. Tiers use the following module combinations:

Module	Tier 3	Tier 2	Tier 1	Tier 0
A: Organizational Security	✓	✓	✓	✓
B: Data Protection & Privacy	✓	✓	✓	✓
C: Access Control & Identity		✓	✓	✓
D: Infrastructure & Network Security		✓	✓	✓
E: Incident Response & BCP		✓	✓	✓
F: Compliance & Certifications		✓	✓	✓
G: Application Security			✓	✓
H: Third-Party & Supply Chain Risk			✓	✓
I: Advanced Technical Controls				✓
J: On-Site Audit Protocol				✓

---

MODULE A: Organizational Security

Required for all tiers. Estimated completion time: 20 minutes.

---

A1. Security Program Governance

A1.1 Does your organization have a formally documented 
     Information Security Policy?
     
     [ ] Yes – Policy reviewed within the last 12 months
     [ ] Yes – Policy older than 12 months (date: _______)
     [ ] No – In development (expected completion: _______)
     [ ] No
     
     ► If Yes: Please provide policy version and date of last executive review.
       Supporting evidence: _________________________________

A1.2 Does your organization have a dedicated security function?

     [ ] Yes – Dedicated CISO or equivalent (name/title: _____________)
     [ ] Yes – Security responsibility assigned to IT leadership
     [ ] Yes – Virtual CISO or outsourced security function
     [ ] No dedicated security function
     
A1.3 How many full-time employees are dedicated to information security?
     
     Number: ______
     Ratio to total employees: ______

A1.4 Does your organization conduct annual security awareness training 
     for all employees?
     
     [ ] Yes – Mandatory, with completion tracking (completion rate: ___%)
     [ ] Yes – Voluntary or informal
     [ ] No
     
     ► If Yes: Describe training content and frequency:
       _____________________________________________________

A1.5 Does your organization perform background checks on employees 
     with access to customer data?
     
     [ ] Yes – All employees
     [ ] Yes – Employees in sensitive roles only
     [ ] Yes – At hire only (no recurring checks)
     [ ] No
     [ ] Not applicable (jurisdiction restriction – please explain)

---

A2. Vendor Security Posture

A2.1 Has your organization experienced a security breach or incident 
     involving customer data in the past 3 years?
     
     [ ] No
     [ ] Yes (provide details below)
     [ ] Prefer not to answer
     
     ► If Yes: Date of incident: _______________________________
       Nature of incident: ____________________________________
       Data categories affected: ______________________________
       Number of records: _____________________________________
       Remediation steps taken: _______________________________
       Regulatory notifications made: _________________________

A2.2 Are you currently subject to any regulatory investigations, 
     consent decrees, or legal proceedings related to data security 
     or privacy?
     
     [ ] No
     [ ] Yes (please describe): _______________________________

A2.3 Does your organization have cyber liability insurance?

     [ ] Yes – Coverage amount: $ __________ | Carrier: __________
     [ ] No
     [ ] Currently obtaining

---

MODULE B: Data Protection & Privacy

Required for all tiers. Estimated completion time: 25 minutes.

---

B1. Data Classification & Handling

B1.1 Does your organization maintain a data classification policy?

     [ ] Yes – With defined categories (describe): _______________
     [ ] In development
     [ ] No

B1.2 For data processed on behalf of our organization, 
     describe where data will be stored:
     
     Primary storage location (country/region): _________________
     Backup storage location (country/region): __________________
     Data center operator (AWS, Azure, GCP, own DC, other): _____
     
B1.3 Will our data be used to train AI/ML models?

     [ ] No – Data is never used for model training
     [ ] No – Unless customer explicitly opts in
     [ ] Yes – Data may be used (explain data isolation controls):
       _____________________________________________________
     [ ] Unsure / Not applicable

B1.4 Is our data logically or physically separated from 
     other customers' data?
     
     [ ] Physical separation (dedicated infrastructure)
     [ ] Logical separation (tenant isolation controls – describe): 
       _____________________________________________________
     [ ] No separation (shared data store)
     [ ] Not applicable
     
     ► If logical: Describe tenant isolation mechanisms:
       _____________________________________________________

B1.5 What is your data retention and deletion policy?

     Retention period for customer data: ______________________
     Deletion process upon contract termination: ________________
     Time to complete deletion after request: __________________
     Format of deletion confirmation provided: _________________

---

B2. Encryption

B2.1 Is data encrypted in transit?

     [ ] Yes – TLS 1.2 minimum
     [ ] Yes – TLS 1.3
     [ ] Partial (describe unencrypted paths): __________________
     [ ] No
     
B2.2 Is data encrypted at rest?

     [ ] Yes – AES-256 or equivalent
     [ ] Yes – AES-128
     [ ] No
     [ ] Partial (describe): ___________________________________
     
B2.3 How are encryption keys managed?

     [ ] Customer-managed keys (BYOK)
     [ ] Provider-managed keys (describe HSM/KMS used): _________
     [ ] Shared key management
     [ ] Keys not managed independently
     
B2.4 Is database-level encryption implemented in addition to 
     disk-level encryption?
     
     [ ] Yes
     [ ] No
     [ ] Disk-level only

---

B3. Privacy Compliance

B3.1 Which privacy regulations apply to your organization's 
     operations? (Check all that apply)
     
     [ ] GDPR (EU/EEA)          [ ] CCPA/CPRA (California)
     [ ] HIPAA (US Healthcare)  [ ] PCI-DSS (Payment Cards)
     [ ] SOX (Financial)        [ ] FERPA (Education)
     [ ] PIPEDA (Canada)        [ ] LGPD (Brazil)
     [ ] PDPA (Thailand/Singapore) [ ] Other: _______________
     
B3.2 Are you willing to execute a Data Processing Agreement (DPA)?

     [ ] Yes – Standard DPA available (provide link): ___________
     [ ] Yes – Will negotiate DPA terms
     [ ] No – Explain: _______________________________________
     
B3.3 If processing EU personal data: Do you rely on Standard 
     Contractual Clauses (SCCs) for international transfers?
     
     [ ] Yes – Current SCCs (2021) in place
     [ ] Yes – Legacy SCCs (being updated)
     [ ] BCR (Binding Corporate Rules) – provide reference
     [ ] Adequacy decision applies
     [ ] Not applicable
     [ ] No transfer mechanism in place
     
B3.4 Do you maintain a Record of Processing Activities (ROPA)?

     [ ] Yes
     [ ] In development
     [ ] No
     [ ] Not required in our jurisdiction

---

MODULE C: Access Control & Identity

Required for Tier 2, 1, and 0.

---

C1.1 Does your product support Single Sign-On (SSO)?

     [ ] Yes – SAML 2.0
     [ ] Yes – OIDC/OAuth 2.0
     [ ] Yes – Both SAML and OIDC
     [ ] Roadmap (expected: _____________)
     [ ] No
     
     ► Note: SSO is a contractual requirement for Tier 1/2 vendors.

C1.2 Does your product support Multi-Factor Authentication (MFA)?

     [ ] Yes – Enforced for all users (cannot be disabled)
     [ ] Yes – Available but not enforced (can be made mandatory)
     [ ] Yes – Admin accounts only
     [ ] No
     
C1.3 Describe your internal employee access control approach:

     Privileged Access Management solution used: _______________
     Just-in-time access provisioning: [ ] Yes  [ ] No
     Access reviews conducted: [ ] Quarterly [ ] Semi-annual [ ] Annual [ ] Ad hoc
     Separation of duties enforced: [ ] Yes  [ ] No
     
C1.4 How is access to production customer data controlled internally?

     [ ] No employees have standing access to production data
     [ ] Limited named employees with logged access
     [ ] Break-glass procedure with approval workflow
     [ ] Engineers have routine access
     [ ] Describe: ___________________________________________
     
C1.5 Are all privileged actions in production environments logged?

     [ ] Yes – Immutable audit logs with timestamps
     [ ] Yes – Logs maintained but not immutable
     [ ] Partial
     [ ] No
     
     Log retention period: ___________________________________

---

MODULE D: Infrastructure & Network Security

Required for Tier 2, 1, and 0.

---

D1.1 Where is your application hosted?

     [ ] AWS        Region(s): _______________________________
     [ ] Azure      Region(s): _______________________________
     [ ] GCP        Region(s): _______________________________
     [ ] Own data centers (locations): ________________________
     [ ] Co-location facility (provider): _____________________
     [ ] Hybrid (describe): __________________________________
     
D1.2 Does your organization conduct regular vulnerability scanning?

     [ ] Yes – Automated scanning (frequency): _________________
                Tool(s) used: ________________________________
     [ ] Yes – Manual scanning only
     [ ] No
     
D1.3 Does your organization conduct penetration testing?

     [ ] Yes – Annual third-party pentest (last date): ___________
                Testing firm: ________________________________
                Scope: ______________________________________
     [ ] Yes – Internal team only
     [ ] No
     
     ► Tier 1/0 Requirement: Provide executive pentest summary 
       or attestation letter from testing firm.

D1.4 How quickly are critical vulnerabilities remediated?

     Critical (CVSS 9.0+): ___ days SLA
     High (CVSS 7.0–8.9): ___ days SLA
     Medium (CVSS 4.0–6.9): ___ days SLA
     
D1.5 Does your organization use a Web Application Firewall (WAF)?

     [ ] Yes  [ ] No  Product: _______________________________
     
D1.6 Describe your network segmentation approach:
     _______________________________________________________
     
D1.7 Is your production environment separated from development 
     and staging environments?
     
     [ ] Complete physical/logical separation
     [ ] Logical separation only
     [ ] Partial separation
     [ ] No separation

---

MODULE E: Incident Response & Business Continuity

Required for Tier 2, 1, and 0.

---

E1.1 Does your organization have a documented Incident Response Plan?

     [ ] Yes – Tested within the last 12 months (test type): _____
     [ ] Yes – Not tested recently
     [ ] In development
     [ ] No
     
E1.2 What is your contractual commitment for notifying customers 
     of a security incident affecting their data?
     
     Notification timeframe: ___ hours from detection/confirmation
     Notification method: ____________________________________
     Named security contact for notifications: _________________
     
     ► Note: Our contract requires notification within 48 hours 
       of confirmed breach. Please confirm capability.

E1.3 Does your organization maintain a Business Continuity Plan (BCP)?

     [ ] Yes – Tested within the last 12 months
     [ ] Yes – Not recently tested
     [ ] No

E1.4 What are your published SLA commitments?

     Uptime guarantee: ______% | Measurement period: ___________
     Planned maintenance window: ______________________________
     Status page URL: _______________________________________
     
E1.5 What are your Recovery Time and Recovery Point Objectives?

     RTO (Recovery Time Objective): ___________________________
     RPO (Recovery Point Objective): __________________________
     Backup frequency: _______________________________________
     Backup testing frequency: ________________________________
     Geographic redundancy: [ ] Yes  [ ] No  Locations: ________
     
E1.6 Have you experienced unplanned downtime exceeding your SLA 
     in the past 12 months?
     
     [ ] No
     [ ] Yes – Incident date(s): ______________________________
                Duration: ___________________________________
                Root cause: _________________________________
                Resolution: _________________________________

---

MODULE F: Compliance & Certifications

Required for Tier 2, 1, and 0.

---

F1.1 Current Security Certifications (provide copies or portal access):

     ┌──────────────────┬──────────────┬─────────────┬──────────┐
     │ Certification    │ Current?     │ Expiry Date │ Auditor  │
     ├──────────────────┼──────────────┼─────────────┼──────────┤
     │ SOC 2 Type II    │ [ ]Yes [ ]No │             │          │
     │ SOC 2 Type I     │ [ ]Yes [ ]No │             │          │
     │ ISO 27001        │ [ ]Yes [ ]No │             │          │
     │ ISO 27701        │ [ ]Yes [ ]No │             │          │
     │ PCI-DSS (level)  │ [ ]Yes [ ]No │             │          │
     │ HIPAA BAA Signed │ [ ]Yes [ ]No │             │          │
     │ FedRAMP          │ [ ]Yes [ ]No │             │          │
     │ CSA STAR         │ [ ]Yes [ ]No │             │          │
     │ Other: ________  │ [ ]Yes [ ]No │             │          │
     └──────────────────┴──────────────┴─────────────┴──────────┘

F1.2 SOC 2 Report Details (if applicable):

     Trust Service Criteria covered:
     [ ] Security  [ ] Availability  [ ] Processing Integrity
     [ ] Confidentiality  [ ] Privacy
     
     Report period covered: ________________________
     Qualified opinion issued: [ ] Yes (explain)  [ ] No
     
     ► Tier 1/0: Full SOC 2 Type II report sharing is required 
       under NDA. Bridge letter required if report > 6 months old.
       
F1.3 Are you willing to share compliance reports under NDA?

     [ ] Yes – Standard mutual NDA sufficient
     [ ] Yes – Requires our specific NDA template review
     [ ] No – Provide reason: ________________________________
     
F1.4 Does your organization maintain compliance with relevant 
     export control regulations?
     
     [ ] Yes – EAR/ITAR compliant (if applicable)
     [ ] Not applicable
     [ ] Unsure

---

MODULE G: Application Security

Required for Tier 1 and 0.

---

G1.1 Does your organization follow a Secure Software Development 
     Lifecycle (SSDLC)?
     
     [ ] Yes – Formal SSDLC with documented controls
     [ ] Partial – Ad hoc security practices
     [ ] No

G1.2 Is static application security testing (SAST) integrated 
     into your CI/CD pipeline?
     
     [ ] Yes – Tool(s): ___________________________________
     [ ] Manual code review only
     [ ] No
     
G1.3 Is dynamic application security testing (DAST) performed?

     [ ] Yes – Automated in pipeline | Tool(s): ______________
     [ ] Yes – Periodic manual testing
     [ ] No
     
G1.4 Do you conduct software composition analysis (SCA) 
     to identify vulnerable dependencies?
     
     [ ] Yes – Automated | Tool(s): _________________________
     [ ] Manual review
     [ ] No
     
G1.5 Do you have a published vulnerability disclosure program 
     or bug bounty program?
     
     [ ] Yes – Bug bounty (platform/URL): ____________________
     [ ] Yes – Responsible disclosure policy (URL): ____________
     [ ] No – Describe how researchers can report: ____________
     
G1.6 Are OWASP Top 10 vulnerabilities specifically addressed 
     in your security testing?
     
     [ ] Yes – Tested against current OWASP Top 10
     [ ] Partial
     [ ] No
     
G1.7 API Security:

     Authentication mechanism: [ ] OAuth 2.0  [ ] API Keys  [ ] Other: ___
     Rate limiting implemented: [ ] Yes  [ ] No
     API versioning with deprecation policy: [ ] Yes  [ ] No

---

MODULE H: Third-Party & Supply Chain Risk

Required for Tier 1 and 0.

---

H1.1 Does your organization assess the security of your own 
     critical third-party vendors?
     
     [ ] Yes – Formal vendor assessment program
     [ ] Yes – Informal/ad hoc reviews
     [ ] No

H1.2 List critical sub-processors that will handle our data:

     ┌────────────────┬─────────────┬───────────────┬──────────────┐
     │ Sub-processor  │ Service     │ Data Accessed │ Location     │
     ├────────────────┼─────────────┼───────────────┼──────────────┤
     │                │             │               │              │
     │                │             │               │              │
     │                │             │               │              │
     └────────────────┴─────────────┴───────────────┴──────────────┘
     
H1.3 Will you notify us before adding new sub-processors 
     that will access our data?
     
     [ ] Yes – Prior written notice (timeframe: ___ days)
     [ ] Yes – Notice provided but not prior approval
     [ ] No – Sub-processor list maintained on website
     
H1.4 Do you conduct software supply chain security practices?

     [ ] SBOM (Software Bill of Materials) maintained
     [ ] Signed software artifacts
     [ ] Dependency pinning and verification
     [ ] None of the above
     
H1.5 Has your organization or a critical sub-processor experienced 
     a supply chain compromise (e.g., SolarWinds-type attack)?
     
     [ ] No
     [ ] Yes (describe impact and remediation): ________________

---

MODULE I: Advanced Technical Controls

Required for Tier 0 only.

---

I1.1 Describe your Zero Trust architecture implementation:
     _______________________________________________________
     
I1.2 Do you implement runtime application self-protection (RASP)?
     [ ] Yes  [ ] No  [ ] Under evaluation

I1.3 Describe your security information and event management 
     (SIEM) implementation:
     
     SIEM Platform: ________________________________________
     Retention period for security logs: _____________________
     24/7 SOC coverage: [ ] Internal  [ ] Managed SOC  [ ] None
     Mean time to detect (MTTD): ____________________________
     Mean time to respond (MTTR): ___________________________
     
I1.4 Do you implement data loss prevention (DLP) controls?

     [ ] Yes – Endpoint DLP
     [ ] Yes – Network DLP
     [ ] Yes – Cloud DLP
     [ ] No

I1.5 Customer-specific encryption key management:

     [ ] Customer-managed keys (BYOK) supported
     [ ] Customer-managed HSM integration supported
     [ ] Provider-managed only
     
I1.6 Describe your approach to insider threat detection:
     _______________________________________________________

---

4. Compliance Scoring Criteria

4.1 Scoring Methodology

Each question is weighted by risk impact and scored on the following scale:

Response Quality Scale:

Score	Meaning
4	Fully implemented, documented, tested, with evidence available
3	Implemented but lacking documentation or recent testing
2	Partially implemented or in active development
1	Planned but not yet started
0	Not implemented / No
-5	Critical finding – disqualifying response (see Section 4.3)

---

4.2 Module Weighting & Maximum Scores

Module	Weight	Max Raw Score	Weighted Max
A: Organizational Security	10%	40	40
B: Data Protection & Privacy	20%	80	80
C: Access Control & Identity	15%	60	60
D: Infrastructure & Network	15%	60	60
E: Incident Response & BCP	15%	60	60
F: Compliance & Certifications	15%	60	60
G: Application Security	5%	20	20
H: Supply Chain	5%	20	20
Total	100%	400	400

Modules G and H are scored when applicable. If not required for tier, remaining weight redistributes proportionally.

---

4.3 Critical Findings (Automatic Disqualifiers)

The following responses result in an immediate HOLD on vendor engagement and mandatory IS escalation regardless of overall score:

CRITICAL FINDING TRIGGERS:
═══════════════════════════════════════════════════════════

CF-01: Active, unresolved breach or regulatory investigation 
       involving customer data (B2.2, A2.2)

CF-02: No encryption in transit for data transfers (B2.1 = "No")

CF-03: Customer data co-mingled with vendor's own operational 
       data with no separation (B1.4 = "No separation")

CF-04: Breach notification timeframe exceeds 72 hours 
       contractual maximum (E1.2)

CF-05: No MFA available for any user accounts (C1.2 = "No")
       [Applies to Tier 1/2 vendors]

CF-06: Sub-processors in jurisdictions with inadequate data 
       protection without appropriate transfer mechanisms (B3.3)

CF-07: No independent security audit in the past 24 months 
       for Tier 1/0 vendors (F1.1 all "No")

CF-08: Confirmed use of customer data for AI training without 
       explicit opt-in mechanism (B1.3 = "Yes – used")

CF-09: Evidence of intentional misrepresentation in questionnaire

CF-10: Vendor refuses to execute required DPA for data 
       processing relationships (B3.2 = "No")

---

4.4 Risk Score Thresholds & Outcomes

┌────────────────────────────────────────────────────────────────┐
│                    SCORING OUTCOMES                            │
├──────────┬──────────────┬───────────────────────────────────── │
│  Score   │  Rating      │  Outcome                            │
├──────────┼──────────────┼────────────────────────────────────  │
│ 360–400  │  EXCELLENT   │  Approve. Standard contract terms.  │
│ (90%+)   │              │  Annual reassessment.               │
├──────────┼──────────────┼──────────────────────────────────── │
│ 320–359  │  GOOD        │  Approve. Standard contract terms.  │
│ (80–89%) │              │  Note areas for improvement.        │
├──────────┼──────────────┼──────────────────────────────────── │
│ 280–319  │  ACCEPTABLE  │  Conditional approval with          │
│ (70–79%) │              │  remediation plan. Enhanced         │
│          │              │  contractual protections required.  │
│          │              │  6-month follow-up assessment.      │
├──────────┼──────────────┼──────────────────────────────────── │
│ 240–279  │  MARGINAL    │  CISO approval required.            │
│ (60–69%) │              │  Formal remediation plan within     │
│          │              │  30 days. Quarterly monitoring.     │
│          │              │  Enhanced contractual protections.  │
├──────────┼──────────────┼──────────────────────────────────── │
│ Below    │  INADEQUATE  │  Reject or defer. Vendor must       │
│ 240      │              │  demonstrate remediation before     │
│ (<60%)   │              │  re-engagement. Executive           │
│          │              │  notification required.             │
└──────────┴──────────────┴──────────────────────────────────── │

---

Vendor Risk Assessment Framework for SaaS Providers

A comprehensive framework should combine risk categorization, structured questionnaires, compliance scoring, and escalation protocols to systematically evaluate third-party SaaS vendors before integration.

1. Risk Tiering and Vendor Categorization

Begin by inventorying your vendor ecosystem and categorizing vendors into risk tiers based on three factors: the sensitivity of data they access, the criticality of their service to your operations, and the level of integration with your systems[1]. This prevents over-assessment of low-risk vendors and ensures critical vendors receive appropriate scrutiny.

Risk tier framework:

Tier	Data Sensitivity	Service Criticality	Example	Assessment Depth
Critical	High (customer PII, payment data)	Essential to operations	Cloud infrastructure provider, payment processor	500+ question comprehensive assessment
High	Moderate-High (internal data)	Important but not essential	HR systems, financial reporting tools	200-300 questions
Medium	Moderate (operational data)	Standard functions	Project management, communication tools	100-150 questions
Low	Minimal (non-sensitive)	Supplementary	Office supplies, general marketing vendors	50 questions or basic assessment

2. Core Assessment Areas and Questions

Structure questionnaires to evaluate five critical domains[1][2][3]:

Data Protection and Compliance

• What data classification scheme does the vendor use?
• What encryption standards are implemented (e.g., AES-256, TLS 1.3) for data in transit and at rest?
• How does the vendor segregate customer data in multi-tenant environments?
• What data retention and destruction practices are documented?
• Provide evidence of compliance certifications (SOC 2, ISO 27001, GDPR, HIPAA) with audit dates[1]

Security Controls and Vulnerability Management

• What is the vendor's network security architecture?
• What endpoint protection and multi-factor authentication (MFA) requirements are enforced?
• How frequently does the vendor conduct vulnerability scans?
• What is the patch timeline for critical vulnerabilities?
• Does the vendor conduct regular penetration testing?[1]

Access Control

• What user authentication mechanisms are in place?
• Is multi-factor authentication mandatory for all users?
• How are permissions and privileged access managed?
• Is there a documented Access Control Plan (ACP) specifying provisioning, approval, and change management processes?[1]

Incident Response and Business Continuity

• Does the vendor have a documented incident response playbook?
• What are the Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO)?
• How frequently are backup restoration procedures tested?
• Is geographically distributed redundancy maintained?
• What is the breach notification timeline and process?[1]

Subcontractor and Third-Party Risk

• Does the vendor outsource critical services?
• What security controls are required of subcontractors?
• How are subcontractor security practices monitored?[3]

3. Framework Selection

Choose questionnaire frameworks aligned with your vendor types[1]:

Framework	Focus	Best For	Question Count
SIG (Standardized Information Gathering)	Comprehensive risk domains	Large enterprises, financial services	1,000+ (Full) / 150+ (Lite)
CAIQ (Consensus Assessments Initiative)	Cloud security controls, multi-tenancy, virtualization	Cloud service providers, SaaS vendors	280+
VSA (Vendor Security Alliance)	Balanced fundamentals (data protection, access controls, incident response)	Mid-market vendors, general use	100-150

For SaaS-specific assessments, CAIQ provides targeted questions about cloud-specific threats, while VSA offers practical coverage for mid-market vendors[1].

4. Compliance Scoring Methodology

Develop a standardized scoring system to compare vendors objectively[2]:

Risk Category Scoring Matrix:

Risk Category	Assessment Criteria	Scoring Scale	Pass Threshold
Data Security	Encryption protocols, data storage policies, backup/recovery measures	0-25 points	≥20
Access Control	Authentication, MFA, permission management	0-25 points	≥20
Compliance	GDPR, HIPAA, SOC 2, ISO 27001 adherence	0-25 points	≥20
Incident Response	Breach notification policies, response times, disaster recovery	0-25 points	≥20
Infrastructure Security	Vulnerability scanning, penetration testing, patch management	0-20 points	≥16

Scoring guidelines:

• Evidence-based scoring: Accept only verified documentation (SOC 2 reports, ISO 27001 certificates, penetration test summaries) rather than vendor self-attestations[1]
• Residual risk column: After vendors answer each question, have them score inherent risk, list existing controls, and assign a residual risk score to identify gaps requiring compensating measures[2]
• Total scoring: Calculate overall vendor score (0-120 points). Scores below 80 require escalation or remediation plans[2]

5. Response Validation Checks

Implement automated or manual validation procedures[1]:

• Flag inconsistent answers across multiple questions
• Verify responses against external data sources (breach notifications, threat intelligence)
• Request evidence for all compliance claims rather than accepting verbal assurances
• Cross-reference current audit dates—outdated certifications indicate potential control gaps[1]

6. Escalation and Decision Workflows

Establish clear escalation paths for procurement teams[2]:

Finding	Responsibility	Action	Timeline
Score ≥100	Procurement	Approve with standard contract terms	Proceed to negotiation
Score 80-99	Security + Procurement	Request remediation plan; conditional approval with enhanced monitoring	2-week remediation window
Score 60-79	CISO + Procurement	Require compensating controls or alternative vendor evaluation	4-week evaluation period
Score <60	CISO + Legal + Procurement	Reject or escalate to executive leadership for risk acceptance	Executive review required

Escalation triggers (immediate CISO review):

• No formal incident response process documented
• Missing or outdated compliance certifications (>12 months old)
• Unknown or high-risk subcontractors with no security controls[3]
• No evidence of vulnerability scanning or penetration testing
• Data encryption not implemented for sensitive information[1]

7. Implementation Best Practices

Multi-framework mapping: Design questions that satisfy multiple compliance standards simultaneously—a single encryption question can address GDPR, HIPAA, PCI DSS, and SOC 2 requirements if properly mapped[1].

Right-sizing questionnaires: Match assessment depth to vendor risk tier. A production cloud infrastructure provider warrants 500+ questions, while a marketing vendor with no data access needs only 50 targeted questions[1].

Continuous monitoring: Supplement periodic questionnaires with real-time updates on vendor security posture, breach notifications, and external risk indicators through integrations with vulnerability scanners and threat intelligence feeds[1].

Documentation: Maintain a vendor risk register tracking assessment dates, scores, remediation plans, and re-assessment schedules. Critical vendors should be reassessed annually; medium-risk vendors every 18-24 months[2].

This framework ensures consistent, evidence-based vendor evaluation while enabling your procurement team to make informed decisions aligned with organizational risk tolerance.