A vendor is critical when its failure, compromise or sudden exit would seriously harm your operations, your customers or your legal position, and you could not replace it quickly. Five questions about data, access, dependence, substitutability and regulation will sort most suppliers.
The five questions
- Data. Does the vendor hold or process sensitive or regulated data, or data your customers trust you with?
- Access. Does it have privileged access to production, source code, identity or money?
- Dependence. If it stopped tomorrow, would a core process stop?
- Substitutability. How long would it take to move, and what would moving cost?
- Obligation. Does a law, contract or customer demand specific oversight of this supplier?
One strong yes can be enough. Several moderate answers can also add up.
Turning answers into a tier
| Pattern of answers | Typical tier |
|---|---|
| Any strong yes on data, access or dependence, plus hard to replace | Critical |
| Moderate on two or more | Important |
| Little data, no access, easy to replace | Standard |
| No data, no access, no integration | Minimal |
Treat the table as a starting point and write down the reasoning for each decision. The reason matters more than the label.
Dependence is easy to miss
Teams focus on data and forget availability. A scheduling tool, an email sending service or a feature flag provider may hold little sensitive data and still halt customer facing work if it goes down. Ask each team which outside services their key processes need to run.
Concentration matters too. Several tools that all rely on one underlying provider can fail together. See vendor concentration risk for how to spot this.
Include open source
Some of your most critical suppliers are projects, not companies. A library that sits in every service is a dependency in the same sense. There is no contract to lean on, so assess maintainer activity, release practice and your own ability to replace or fork it. See the checklist before adding a new open source dependency.
What changes for critical vendors
| Area | Critical | Standard |
|---|---|---|
| Evidence depth | Independent reports plus your own checks | Basic documents |
| Review cadence | Yearly plus event triggers | At renewal |
| Contract terms | Notice, audit, exit rights | Standard terms |
| Exit plan | Written and tested | Not required |
Revisit the list
Criticality moves as your business changes. A vendor that was standard last year may now sit in a core process. Recheck the list when you launch a major product, enter a regulated market or consolidate tools.
Quick check
Can a free tool be a critical vendor?
Yes. Price has no bearing on criticality. What matters is the data it holds, the access it has and how much you depend on it.
How many vendors should be critical?
Few. If most suppliers are critical, the label no longer helps you focus. Tighten the criteria.
Safeguard's SBOM and dependency scanning and asset discovery can help you see which components and suppliers sit under your products, and a free scan is at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
