A vendor risk assessment is a structured review of how much harm a supplier could cause your business and whether its controls reduce that harm to an acceptable level. You run one by listing vendors, tiering them, collecting evidence, scoring gaps, deciding, and then reviewing again on a schedule.
What it is and what it is not
The assessment answers one question: should we rely on this supplier for this purpose, and on what conditions? It is not a questionnaire, although a questionnaire may be one input. It is also not a pass or fail stamp on the vendor. The same supplier can be fine for a marketing tool and wrong for a system that holds customer records.
NIST describes cybersecurity supply chain risk management as identifying, assessing and mitigating risks from the products and services an organization acquires, including limited visibility into how that technology is built and deployed. Its publication on the topic is SP 800-161 Rev. 1. Check the NIST page for the current revision, because the version history has changed.
The six steps
- Inventory. List every vendor, including free tools that staff signed up for. You cannot assess what you have not found.
- Tier. Sort by what the vendor touches: customer data, production access, code, money, or nothing sensitive. Spend effort where the tier is high.
- Collect evidence. Ask for the smallest set that answers your questions: an audit report, a penetration test summary, a software bill of materials, a data processing agreement.
- Score the gaps. Compare what you received against what the tier requires. Write down each gap as a specific statement, not a color.
- Decide. Approve, approve with conditions, or decline. Conditions might be a contract clause, a narrower integration, or a compensating control on your side.
- Review. Set a date. High tiers get a fixed cadence and event triggers such as a breach notice or an ownership change.
What a good output looks like
| Output | Why it matters |
|---|---|
| Vendor name, owner, business purpose | Someone is accountable |
| Tier and the reason for it | The reason survives staff changes |
| Evidence received with dates | Shows how fresh the picture is |
| Open gaps and decisions | Records what you accepted and why |
| Next review date | Turns a one time task into a process |
Common ways it goes wrong
Teams often assess at purchase and never again. They also treat a long questionnaire as proof, when answers are claims until something backs them. And they give every vendor the same depth, which means the critical ones get too little attention. See how to tier vendors by risk for a simple three tier model.
Try it yourself
Click through the dependency inventory demo to see how components and suppliers show up when you scan your own software, then note which ones would belong in a higher vendor tier.
Click through it at your own pace, or open it full screen.
Quick check
Is a vendor risk assessment the same as a security questionnaire?
No. A questionnaire collects the vendor's own statements. The assessment weighs those statements against evidence and against how much your business depends on the vendor, then ends in a decision.
How often should a vendor be reassessed?
It depends on the tier. High tier vendors usually get a yearly review plus reviews triggered by events such as a breach or acquisition. Low tier vendors can be reviewed less often or only when scope changes.
Safeguard can scan the software you run and produce SBOMs and dependency findings that feed the evidence step, and you can try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
