Tier vendors by what they touch and what happens if they fail. Three tiers is enough: critical, standard and low. Use three questions: how sensitive is the data, how deep is the access, and how badly would an outage hurt. Then give each tier a fixed review depth.
Why tiering comes first
Without tiers, every vendor gets the same questionnaire or none at all. Both waste effort. A design tool with no customer data does not need the review a payments processor needs. Tiers let a small team spend time where loss is possible.
The three questions
Score each vendor on three points, low, medium or high:
- Data. What is the most sensitive data they store or process? Public marketing data is low. Customer personal data or credentials is high.
- Access. Do they connect to your production systems, your source code or your identity provider? Read-only access to a calendar is low. Write access to production is high.
- Dependence. If they were down for a week, what breaks? A nice-to-have tool is low. A system in your revenue path is high.
Turn scores into tiers
A rule that works without a spreadsheet:
- Critical: any high score on data or access, or a high score on dependence.
- Standard: one or more mediums and no highs.
- Low: all lows.
Resist adding weights and decimals. Nobody can defend why a vendor scored 6.4 rather than 6.1.
Match review depth to tier
| Tier | At onboarding | Ongoing |
|---|---|---|
| Critical | Full questionnaire, independent report, contract review, exit plan | Annual review, notice of changes, incident contact tested |
| Standard | Short questionnaire, security page check | Review every two years or on change |
| Low | Terms check, single sign-on where possible | Review at renewal |
That table is a starting point, not a standard. Adjust it to your size.
Common mistakes
- Tiering by contract value. A cheap tool can hold your whole customer list.
- Forgetting free tools and browser extensions that staff adopt on their own.
- Never retiering. A vendor that added a new feature last year may have moved up a tier.
- Treating a tier as permanent after an incident.
Keep an inventory
You cannot tier what you cannot list. Pull a vendor list from accounts payable, single sign-on logs and expense reports. Safeguard's asset discovery and SBOM and dependency scanning can help you see software components and services your own code relies on, which often surfaces suppliers nobody put on the list.
Quick check
How many vendor tiers should a small company use?
Three is enough. More tiers add argument without changing what you do.
Should contract value decide the tier?
No. Data and access decide risk. A low-cost vendor can hold sensitive data.
Last reviewed: 19 October 2026.
