Folio 2The work · assessing a third party
Vendor risk assessment, step by step and by tool
How an assessment of a supplier or service provider actually runs, what to ask each tier for, a template you can download, and which products in the register automate each step or do it for you.
A vendor risk assessment asks what a third party could do to you if it failed or was breached, then checks what it has in place. It runs in six steps: inventory, tier by inherent risk, collect evidence, analyse findings, agree fixes, and monitor until offboarding. The tier decides the depth: a SIG Core and a SOC 2 report for critical vendors, a short questionnaire for low-risk ones.
The six steps
Know who your third parties are
Build the inventory: every supplier, service provider, partner and affiliate, what it does for you, what data and systems it touches, and who owns the relationship internally. Most programs start from accounts payable and find more in single sign-on logs and expense reports.
Tier them by inherent risk
Before asking anything, decide how much could go wrong: the sensitivity of the data, the access to your systems, how critical the service is, how hard it would be to replace. The tier sets how deep the assessment goes and how often it repeats.
Collect the evidence
Send a questionnaire sized to the tier (SIG Lite has 128 questions, SIG Core 627, the CAIQ 283), and ask for the documents that prove the answers: a SOC 2 Type II report, an ISO 27001 certificate with its scope, a penetration-test summary. Check what can be seen from outside, too.
Analyse and record findings
Compare the answers with the evidence and with your requirements. Record each gap as a finding with a severity and an owner. Read the SOC 2 report’s exceptions and its complementary user-entity controls: the controls you must run yourself.
Decide, and agree fixes
Accept, accept with conditions, or reject. Conditions become remediation items with dates, and the important ones go into the contract: notification times, audit rights, subcontractor approval, exit terms.
Monitor, reassess and offboard
Watch for breaches, rating drops, ownership changes and financial trouble between assessments; reassess on the tier’s schedule; and when the relationship ends, confirm data is returned or destroyed and access removed.
Tier first, then ask
The same 40-page questionnaire for every vendor wastes everyone’s time. Tiering by inherent risk, before anything is sent, sets the depth and the schedule. A common three-tier starting point:
| Tier | Who falls in it | Evidence to ask for | Reassess |
|---|---|---|---|
| 1 | Critical. Supports a critical activity, holds sensitive or regulated data at scale, or would be hard to replace quickly. | SIG Core or equivalent, SOC 2 Type II, pen-test summary, BC/DR test, financials, plus continuous outside-in monitoring. | Before contract, then every year, and on any incident or major change. |
| 2 | High. Holds confidential data or connects to your systems, but is replaceable. | SIG Lite or CAIQ, SOC 2 or ISO 27001, incident and privacy terms. | Before contract, then every two years. |
| 3 | Moderate or low. Little or no access to data or systems; low cost of failure. | A short questionnaire or certificate check; a security rating if available. | Before contract, then at renewal. |
A starting point, not a rule: US banking guidance asks for more rigorous oversight of third parties that support critical activities, and leaves the tiers to each bank. See the TPRM framework page for the rules.
A vendor risk assessment template
15 areas, the question to ask in plain words, the evidence that answers it, and which tiers to ask. Each row is tied to its SIG risk domain and Cloud Controls Matrix domain, so it can be swapped for the standard question sets later.
| Area | Question | Evidence to request | Tiers | SIG · CCM |
|---|---|---|---|---|
| Governance | Who is accountable for security, and is there a written security program reviewed at least yearly? | Security policy index with owners and review dates; org chart for the security function | 1, 2, 3 | Enterprise Risk Management · GRC |
| Independent assurance | Which independent audits or certifications cover the service you provide us, and do they cover the systems that hold our data? | SOC 2 Type II report (and bridge letter), ISO/IEC 27001 certificate with its scope, PCI DSS attestation if cards are in scope | 1, 2, 3 | Compliance Management · A&A, GRC |
| Access control | How is access to our data granted, reviewed and removed, and is multi-factor authentication required for staff and administrators? | Access-review records for the last two quarters; MFA policy | 1, 2 | Access Control · IAM |
| Data handling | What of our data do you hold, where, for how long, and is it encrypted at rest and in transit? | Data-flow diagram; data inventory; encryption standard; retention schedule | 1, 2, 3 | Asset and Information Management · DSP |
| Privacy | Do you process personal data for us, under what agreement, and how do you meet deletion and access requests? | Data processing agreement; privacy notice; record of processing for the service | 1, 2 | Privacy Management · DSP |
| Application security | How is the software you provide built, tested and patched, and when was it last penetration tested? | Secure development policy; latest penetration-test summary and remediation status | 1, 2 | Application Management · AIS |
| Infrastructure | How are the networks and servers that run the service segmented, hardened, monitored and patched? | Architecture overview; vulnerability-management policy with patch timelines | 1 | Network Security · IVS |
| Cloud hosting | Which cloud providers and regions host the service, and who is responsible for which controls? | Shared-responsibility matrix; completed CAIQ or CSA STAR entry where one exists | 1, 2 | Cloud Services · IVS, IPY |
| Incident response | How fast will you tell us about an incident that affects our data or service, and who will call us? | Incident response plan; contractual notification clause; last tabletop exercise date | 1, 2, 3 | Cybersecurity Incident Management · SEF |
| Resilience | What are the recovery time and recovery point for the service, and when were they last tested? | Business continuity and disaster recovery plans; most recent test report | 1, 2 | Operational Resilience · BCR |
| People | Are staff with access to our data background-checked and trained, and is access removed when they leave? | Screening policy; training completion record; leaver process | 1, 2 | Human Resources Security · HRS |
| Fourth parties | Which subcontractors touch our data or the service, and how do you assess them? | Subprocessor list with locations; your own third-party risk policy | 1, 2 | Nth Party Management · STA |
| Physical security | Where is our data physically processed, and who controls those facilities? | Facility list; data-center provider reports (often inherited from the cloud provider) | 1 | Physical and Environmental Security · DCS |
| AI use | Do you use AI models on our data, whose models, and is our data used to train them? | AI use policy; model provider list; contractual no-training terms | 1, 2 | Artificial Intelligence (AI) |
| Financial health | Could the vendor fail or be sold during the contract, and what happens to our data and service if it does? | Financial statements or a credit report; exit and data-return clauses | 1 | Enterprise Risk Management · GRC |
Download the template as CSV (15 rows, CC BY 4.0). Written for this site; it is not the SIG, which is licensed, and not any vendor’s questionnaire. For the standard sets and how they map, see SIG, CAIQ and the others.
Having the assessments done for you
12 vendors in the register say they, or their owner, will run assessments for you as a managed service: collecting evidence, chasing vendors and writing up findings.
| Product | Approach | What the vendor says it does for you |
|---|---|---|
| Venminder | Assessment workflow | Vendiligence™ control assessments by Venminder experts (SOC, financial health, information security and privacy, BC/DR, cybersecurity, data protection, contract compliance, CAIQ, SIG Lite), plus document collection… source |
| Censinet RiskOps | Assessment workflow | Yes: "Hybrid Support" (co-managed Risk Management Services) or "Fully Managed: Censinet Risk Management Services operates your TPRM program end-to-end." source |
| Prevalent | Assessment workflow | Third-Party Risk Managed Services: "Leverage expert-managed services to oversee the third-party risk lifecycle on your behalf." source |
| Risk Ledger | Assessment workflow | "Yes. If you'd rather not run your programme in-house, Risk Ledger is also available as a managed service or through our partners." source |
| ProcessUnity | Assessment workflow | Global Risk Exchange: "Request attested or validated assessments from the world’s most assessed companies and reduce the need to perform due diligence yourself." source |
| SecurityScorecard | Yes: TITAN MAX — "TITAN MAX is a managed service that is built on the SecurityScorecard platform" ("Managed Services for cyber TPRM outcomes") source | |
| UpGuard | Yes: "Vendor risk assessments done for you — Partner with an UpGuard analyst and put your vendor assessments on autopilot." source | |
| Panorays | Professional services help design the program, tier vendors, configure questionnaires and bulk-load suppliers; no done-for-you assessment service is stated. source | |
| Bitsight | Yes: professional services include "managed vendor assessments and board-ready reporting"; pricing FAQ: "We offer Third-Party Risk Management services to help organizations launch programs faster, optimize internal… source | |
| Supplier Shield | GRC suite module | Yes: "Managed Services run directly on the Supplier Shield TPRM module inside Acuna GRC"; pricing matrix lists Managed services as "On request" (Starter) and "Add-on" (Professional, Enterprise). source |
| Centraleyes | GRC suite module | GRC as a Service: 'Immediate access to a pool of certified GRC experts' who run GRC processes on Centraleyes (not described as TPRM-specific) source |
| Vendict | AI-first assessment | Yes: Managed TPRM, where "Vendict runs your vendor risk assessments end-to-end using AI agents combined with expert GRC validation"; tiered by vendor risk (Tier 1 annual, Tier 2 every 2 years, Tier 3 every 3 years). source |
What vendors say their AI does
32 products in the register describe AI features in the assessment. Quoted short, from each vendor’s own page; we have not tested them. Ask what a person still reviews, and whether your vendors’ documents train the model.
| Product | Approach | The vendor’s description |
|---|---|---|
| Venminder | Assessment workflow | Venminder says it uses AI to extract vendor contract metadata and speed its Vendiligence assessments, and does not use customer data to train shared models (June 2024). source |
| Censinet RiskOps | Assessment workflow | The Censinet Risk Assessor Agent reviews questionnaire responses and documentation, identifies potential findings and drafts reports and corrective action plans; vendor claims up to 66% time… source |
| Certa | Assessment workflow | Certa AI agents: Vibe Configuration (policy-to-workflow in natural language), Risk, Pre-Fill, Adjudicate, Contracts and Validation agents, plus the Certa Concierge in-app assistant. source |
| Prevalent | Assessment workflow | ARIES AI digital assistant; AI FastTrack Assessment populates a new questionnaire from up to 15 prior assessments and generates 200+ recommended answers; AI false-positive filtering and LLM event… source |
| Risk Ledger | Assessment workflow | "Summarise profile" gives an AI-generated supplier summary; Auto Suggest uses an AI model (Claude Haiku 4.5) to help suppliers complete assessments. source |
| ProcessUnity | Assessment workflow | ProcessUnity AI Agents for TPRM (Sept 2026), Evidence Evaluator (maps vendor documents to controls), Assessment Autofill and, for third parties, DDQ AutoAssist; ISO/IEC 42001:2023 certified AI… source |
| Aravo | Assessment workflow | Aravo AI (April 2026): workflow agents (Survey, Remediation, Decision), interactive agents in AI Canvas, and a no-code AI Studio where teams can choose which LLMs power their agents. source |
| SecurityScorecard | TITAN AI performs gap analysis on questionnaires and SOC 2 reports and compares vendors' answers against observed technical security behavior; ChatSSC is a conversational AI agent. source | |
| UpGuard | UpGuard AI analyzes vendor documents to build Security Profiles, pre-fills NIST CSF 2.0 and ISO 27001:2022 checks, and generates gap questionnaires that ask only for what is missing. source | |
| Panorays | Panorays says AI cross-references vendor questionnaire answers against uploaded evidence such as SOC 2 reports and ISO certifications and highlights discrepancies for human review. source | |
| Bitsight | Bitsight says it uses AI to summarize SOC 2 reports, pre-populate and validate questionnaire answers, map controls to frameworks, and attribute internet assets to organizations. source | |
| Black Kite | Black Kite says AI parses vendor documents, extracts evidence and maps controls to frameworks, and a network of AI agents runs investigations, assessments and reporting. source | |
| RiskRecon | RiskRecon Assessments (Powered by Whistic) use AI to facilitate assessment responses, summarize documentation such as SOC 2 reports and cross-check compliance across the vendor catalog. source | |
| Interos | AI and machine learning over a knowledge graph of "230+ million global entities across 11+ billion relationships" map suppliers; iQ adds predictive analytics and dollar-exposure estimates. source | |
| LogicGate Risk Cloud | GRC suite module | TPRM Agentic Application with a Third-Party Intake Agent, Third-Party Assessment Agent and TPRM Insights Agent; third parties can autofill questionnaires in a single click. source |
| OneTrust | GRC suite module | OneTrust says AI document scanning reduces assessment time by up to 65% and AI agents can handle intake, screening and risk tiering. source |
| Supplier Shield | GRC suite module | Aiko, an AI agent inside Acuna GRC, proposes vendor risk tiers, drafts evidence-renewal requests, auto-maps new obligations and drafts board summaries. source |
| Centraleyes | GRC suite module | Lists 'AI-powered planning, orchestration, and remediation' as a vendor risk management feature, running on the same 'AI-powered platform' as its internal risk program. source |
| MetricStream | GRC suite module | Third-Party Risk Agents recommend tiers and tailor assessments, AI Survey Autofill drafts responses from evidence, and AI scans SOC 2 and SOC 3 reports for anomalies. source |
| Optro (AuditBoard) | GRC suite module | AI agents tier vendors from an uploaded policy, collect SOC 2/ISO reports from public trust centers and pre-fill questionnaires; Optro says every agent action is logged, auditable and reversible. source |
| Riskonnect | GRC suite module | Riskonnect's Intelligent Risk Framework adds Salesforce Agentforce 360 agent actions across risk areas including third-party risk (announced February 3, 2026). source |
| Archer | GRC suite module | Archer Evolv lets permitted users query the third-party record, grounds answers in the customer's own records and requires a person to approve before the record changes. source |
| ServiceNow | GRC suite module | Third-party Risk Management Advanced and Prime add generative AI to summarize third-party risk issues and identify potential issues during assessment review. source |
| Secureframe | Compliance platform | Comply AI for TPRM extracts answers to security review questions from vendor documents such as SOC 2 reports and policies and populates suggested answers for review. source |
| Vanta | Compliance platform | TPRM Agent discovers vendors, retrieves evidence from vendor trust centers, extracts risks from SOC 2 reports and DPAs, pre-fills assessment questionnaires and flags answers for human review. source |
| Cynomi | Compliance platform | 'CISO Intelligence' weights vendor assessment risks by the vendor's criticality to the client's business operations and regulatory obligations. source |
| Drata | Compliance platform | An agent evaluates each third party against customer-written natural-language standards, pulls documents from vendor Trust Centers, flags gaps, drafts follow-up questions and explains decisions… source |
| VISO TRUST | AI-first assessment | Agentic AI requests vendor artifacts, maps evidence to frameworks and produces explainable inherent and residual risk scores "in under a minute per vendor". source |
| Vendict | AI-first assessment | AI agents chase vendors for documents and answers, locate controls in vendor documentation, analyse them against the customer's standards and surface risks for expert validation. source |
| Whistic | AI-first assessment | AI reads vendor evidence and answers your controls with confidence scores and source citations; Automation Orchestrator runs four agents (Initiator, Collector, Analyst, Reporter) from trigger to… source |
| SAFE TPRM | AI-first assessment | "100+ AI agents" (e.g. Document Analyzer, Inline Review, Vendor Interaction, Threat Intel, Contract Analysis, Fourth-Party Discovery agents) work across five TPRM phases. source |
| Zania | AI-first assessment | AI agents classify vendors by data access and criticality, collect and validate evidence, send follow-ups and produce findings mapped to the customer's controls. source |
Vendor risk assessment software
The products in the register built around running assessments, with the standard questionnaires each names. Full entries, prices and sources are in the register.
| Product | Approach | Questionnaires named | Owner |
|---|---|---|---|
| SecurityScorecard | SIG, CAIQ | Privately held, venture-backed (backers named by the company… | |
| UpGuard | SIG, DORA, HIPAA | Privately held, venture-backed (2026 Series C led by Springc… | |
| VISO TRUST | AI-first assessment | SIG, SOC 2, ISO 27001, NIST CSF, PCI DSS | Protecht Group (acquired VISO TRUST, April 2026); Protecht r… |
| LogicGate Risk Cloud | GRC suite module | SIG, CAIQ | Independent, growth-equity backed ($113M Series C led by PSG… |
| OneTrust | GRC suite module | SIG Core, SIG Lite | Independent, privately held and venture-backed (investors na… |
| Panorays | SIG, CAIQ, NIST CSF, ISO 27001, DORA, PCI DSS | Privately held, venture-backed (2021 Series B led by Greenfi… | |
| Secureframe | Compliance platform | — | Independent, venture-backed (investors listed include Kleine… |
| Supplier Shield | GRC suite module | ISO 27001, SOC 2, NIST CSF, NIST SP 800-53, PCI DSS, NIST 800-171 / CMMC | Abilene Group SA, Morges, Switzerland (its ISO 27001 certifi… |
| Vanta | Compliance platform | — | Independent, venture-backed (backers named include Sequoia C… |
| Vendict | AI-first assessment | — | Independent, venture-backed ($10 million Series A led by Mon… |
| Venminder | Assessment workflow | SIG Core, SIG Lite, CAIQ | Ncontracts (acquired Venminder, 2024), backed by Hg |
| Whistic | AI-first assessment | SIG, CAIQ | Independent, venture-backed (investors listed include Emerge… |
| Bitsight | SIG Lite, NIST CSF, ISO 27001, HECVAT, NIST 800-171 / CMMC | Privately held; Moody's made a $250 million strategic invest… | |
| Black Kite | SIG | Privately held, venture-backed (2021 Series B led by Volitio… | |
| Censinet RiskOps | Assessment workflow | NIST CSF | Independent, venture-backed (investors include HLM Venture P… |
| Centraleyes | GRC suite module | — | Independent; no parent company or investors named on the ven… |
| Certa | Assessment workflow | — | Independent, venture-backed (Series B led by Fin Capital and… |
| Prevalent | Assessment workflow | SIG, CAIQ, ISO 27001, NIST CSF, NIST SP 800-53, NIST 800-171 / CMMC, PCI DSS | Mitratech (acquired Prevalent, 2024) |
| Risk Ledger | Assessment workflow | ISO 27001, NIST CSF | Independent, venture-backed (£24 million Series B led by Axi… |
| RiskRecon | — | Mastercard (NYSE: MA); acquisition agreement announced Decem… | |
| SAFE TPRM | AI-first assessment | — | Independent, venture-backed (raised over $170 million; $70 m… |
| Zania | AI-first assessment | SOC 2, ISO 27001, PCI DSS | Independent, venture-backed ($18M Series A led by NEA, Septe… |
| Cynomi | Compliance platform | — | Independent, venture-backed ($37M Series B co-led by Insight… |
| Drata | Compliance platform | — | Independent, venture-backed |
| MetricStream | GRC suite module | — | Independent, investor-backed: MetricStream lists BlueTorch C… |
| Optro (AuditBoard) | GRC suite module | — | Private equity: Hg (agreed to acquire AuditBoard in May 2024… |
| ProcessUnity | Assessment workflow | — | Private equity: Marlin Equity Partners (majority-control inv… |
| Riskonnect | GRC suite module | — | Private equity: TA Associates (majority owner, invested 2021… |
| Aravo | Assessment workflow | — | Aravo Solutions, Inc.; founder Tim Albinson is Chairman; no… |
| Archer | GRC suite module | — | Private equity: Cinven (acquired from RSA Security, 2023) |
| ServiceNow | GRC suite module | — | Public company (NYSE: NOW) |
Questions
What is a vendor risk assessment?
A structured check of what a supplier or service provider could do to your organisation if it failed, was breached or behaved badly, and of what it has in place to prevent that. It combines the vendor’s answers to a questionnaire, documents that prove them (such as a SOC 2 report), and anything you can see yourself, and ends in a decision and a list of fixes.
How often should vendors be reassessed?
By tier. A common pattern is every year for critical vendors, every two years for high-risk ones, and at renewal for the rest, with an immediate review after a breach, an acquisition or a major change in the service. Regulators expect the frequency to follow the risk rather than one schedule for all.
Is a SOC 2 report enough?
Often, for the security part, if it is a Type II report, covers the service you buy, is recent, and you have read its exceptions and the controls it expects you to run. It says nothing about the vendor’s finances, its subcontractors beyond what is carved in, or its contract terms, so it rarely replaces the whole assessment.
What is the difference between a vendor risk assessment and due diligence?
Due diligence is the assessment done before signing, as part of choosing the vendor. A vendor risk assessment is the same check done at any point in the relationship, including the reassessments that follow. US banking regulators treat due diligence as one stage of a wider third-party risk management lifecycle.
Do we need software to do vendor risk assessments?
Not for a few dozen vendors: a spreadsheet, the template on this page and a shared inbox work. Software pays off when the chasing does not: hundreds of vendors, yearly reassessments, evidence that expires, and auditors who want the trail. 31 products in this register run assessment workflows.
How many vendors do you assess a year?
Tell us the number, the tiers and the rules you answer to. We reply with the products in this register that fit. We only pass your details to a vendor if you ask us to.
Sources for this page
- Interagency Guidance on Third-Party Relationships: Risk Management (Federal Register, June 2023) — Due diligence as a stage of the lifecycle; risk-based depth and frequency.
- Shared Assessments: 2025 SIG release notes (archived) — SIG Lite and SIG Core question counts.
- Cloud Security Alliance: Cloud Controls Matrix and CAIQ v4.1 — The CAIQ question count.
- AICPA: SOC 2 (SOC for Service Organizations: Trust Services Criteria) — What a SOC 2 report is.
- Each vendor’s own pages, as linked in the register — Managed-assessment services and AI claims in the tables.
Each product’s own sources are linked from its entry in the register. How products are chosen and ordered, and how to correct an entry: methodology.
Cite this page
Third-Party Risk Management Software. “Vendor risk assessment: steps, template and tools.” Updated November 8, 2026. https://thirdpartyriskmanagementsoftware.com/vendor-risk-assessment/