What this assessment covers
The score combines data sensitivity, system access, operational criticality, regulatory exposure, subprocessors, resilience, and payment authority. It is an intake triage aid, not a certification or substitute for legal, security, privacy, or financial review.
How to use the result
- Confirm the answers with the business owner and supplier.
- Collect evidence for each action in the checklist.
- Record control gaps and decide whether to mitigate, accept, avoid, or transfer the risk.
- Reassess after material service, data, ownership, or subprocessor changes.
Worked example
The worked example models a payroll provider with restricted data, privileged access, direct regulatory exposure, unknown subprocessors, difficult replacement, and payment authority. It produces a Critical result and the broadest checklist.
Primary guidance
- NIST SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices
- U.S. banking agencies: Third-Party Relationships guidance
Frequently asked questions
Is the score a vendor approval?
No. It identifies the depth of diligence that may be appropriate before a separate risk decision.
Does the tool store answers?
No. Calculation and CSV creation happen in your browser.
When should I reassess?
At least when the service scope, data, access, criticality, ownership, control environment, or fourth-party chain changes.