Vendor Risk Management

100+ vendors, zero visibility on their security

A manufacturing company used 127 ICT vendors. When auditors asked “how do you manage supply chain security?” the answer was: “We have contracts with NDA.” That’s not supply chain security management - that’s wishful thinking.

Without Vendor Risk Management:

• You don’t know which vendors have access to critical data
• You can’t assess their security level
• A vendor breach becomes your breach
• You don’t meet NIS2 Article 21 requirements
• Auditor sees a gap, regulators see a fine

End-to-end VRM process

We take over the entire vendor risk management process - from inventory to continuous monitoring. You get full visibility into supply chain risk and compliance evidence for auditors.

What you get:

• Complete ICT vendor inventory (cloud, SaaS, contractors, hardware)
• Categorization by risk level (Critical/High/Medium/Low)
• Security questionnaires tailored to vendor category
• Due diligence for critical vendors (OSINT, certificate verification)
• Vendor Scorecard with A-E rating
• Recommendations for low-rated vendors (improve or exit)
• Continuous monitoring (breach alerts, certificate changes)
• Contract security clause templates

VRM Process Details

1. Vendor Inventory

Data sources:

• Procurement - contracts and invoices
• Finance - payments to IT vendors
• IT - systems, licenses, integrations
• Security - VPN connections, API keys
• Network scan - external services in use

For each vendor we collect:

• Company name and contact
• Service/product type
• Data processed (personal, business, critical)
• Network access (yes/no, what scope)
• Business owner
• Contract dates

2. Risk Categorization

Category	Criteria	Examples
Critical	Critical data access, single point of failure, no alternative	Cloud provider, ERP, core banking
High	Sensitive data access, significant operations impact	CRM, email, HR system
Medium	Limited access, replaceable	Collaboration tools, monitoring
Low	No data access, minimal impact	Printers, telephony, office supplies

3. Security Assessment

For Critical vendors:

• Full security questionnaire (100+ questions)
• Interview with vendor representative
• Certificate verification (ISO 27001, SOC 2)
• OSINT - incident history check
• Contract security clause review

For High vendors:

• Extended questionnaire (50-80 questions)
• Certificate verification
• OSINT

For Medium vendors:

• Simplified questionnaire (30 questions)
• Basic verification

For Low vendors:

• Minimal or no verification
• Standard contract clauses

4. Vendor Scorecard

Each vendor receives a score based on:

Area	Weight
Governance (policies, CISO, training)	20%
Technical security (MFA, encryption, patching)	30%
Incident management (IR plan, SLA, communication)	20%
Compliance (certificates, GDPR, audits)	15%
History (incidents, reputation)	15%

Rating scale:

Score	Rating	Action
4.0 - 5.0	A - Excellent	Accept, review every 24 months
3.0 - 3.9	B - Good	Accept, review every 12 months
2.0 - 2.9	C - Acceptable	Conditional, improvement plan required
1.0 - 1.9	D - Poor	Reject or exit strategy
< 1.0	E - Critical	Immediate action required

5. Continuous Monitoring

Ongoing:

• Breach alerts (threat intelligence, Google Alerts)
• Certificate change monitoring
• Internal user feedback

Quarterly:

• Critical vendor review
• Improvement plan tracking

Annually:

• Full re-assessment of Critical and High vendors
• Categorization update
• Board report

Who is this for?

This service is for you if:

• You must comply with NIS2 and haven’t addressed Article 21 supply chain requirements
• You have 50+ ICT vendors and no formal VRM process
• Auditors flagged supply chain security as a gap
• You experienced a vendor-related security incident
• You want to reduce third-party risk systematically

Pricing

VRM Assessment (one-time)

Initial assessment and process setup:

• Vendor inventory
• Risk categorization
• Security assessment (questionnaires + due diligence)
• Scorecard delivery
• Contract clause templates

Scope: Up to 100 vendors Time: 4-6 weeks Price from: $15,000

VRM as a Service (ongoing)

Continuous vendor risk management:

• Quarterly reviews and updates
• New vendor assessments
• Incident monitoring
• Improvement tracking
• Annual board report

Price from: $2,500/month

Enterprise VRM

For organizations with 200+ vendors:

• Dedicated VRM analyst
• Custom questionnaire development
• Vendor portal setup
• Integration with GRC tools

Price: Custom quote

Related Glossary Terms

Learn more about key concepts related to this service:

• API
• BEC
• CIS (Center for Internet Security)
• OT (Operational Technology)
• SCA
• SOC
• SSE
• Tor