Skip to content
ENExplore Calculators

Vendor Risk Calculator

Tier a single vendor on data, access, criticality and spend, weigh the assurance evidence, and get residual risk plus a reassessment interval.

About Vendor Risk Calculator

Tiering is driven by data and access rather than by spend, because a cheap tool with an API token in your production tenant outranks an expensive one that never touches your data. Assurance evidence is capped at 70% effectiveness since a certificate describes a scope you did not choose, at a date that has passed, and a questionnaire is only as good as the evidence behind the answers. Vendor tiering decides how much diligence each supplier gets, and getting the tier wrong is how a low-spend integration ends up with unmonitored privileged access. This is a management estimate to prioritise diligence, not an assurance opinion on the vendor.

Formulas

Vendor Risk

Inherent vendor risk = 0.30 × data class + 0.25 × access type + 0.25 × operational criticality + 0.10 × spend band + 0.10 × subprocessor band, on 1–5.

data class
Most sensitive data the vendor touches
access type
From no access through to privileged network access
subScore
Subprocessor count banded, because their supply chain is now yours

Assurance and residual

Residual = inherent × (1 − 0.7 × assurance score) × 1.2 if there is a known breach, where assurance = 0.4 × certification + 0.4 × questionnaire + 0.2 × penetration test evidence.

assurance
Independent evidence outweighs self-attestation
0.7
Even perfect evidence cannot remove more than 70% of the inherent risk, because it is a point-in-time view of someone else's estate

Worked example

With the default values below, Vendor Risk Calculator returns Vendor Risk Verdict of Low — proceed with standard clauses and periodic review. Change any input above and every figure here is recalculated in your browser.

Inputs used

Most sensitive data the vendor handlesone of 1 — No company data, 2 — Public or marketing data, 3 — Internal business data, 4 — Personal data, 5 — Payment, credential or special category data
4 — Personal data
Access the vendor holdsone of 1 — No access, no data, 2 — Data sent to them only, 3 — SaaS holding our data, 4 — Named accounts in our systems, 5 — Privileged or network-level access
3 — SaaS holding our data
Criticality to your operationsone of 1 — Easily replaced within days, 2 — Replaceable within a month, 3 — Important, replacement takes a quarter, 4 — Critical, replacement takes months, 5 — Single source, no realistic alternative
4 — Critical, replacement takes months
Annual contract valueaccepts 0–10,000,000,000 $
480,000 $
Independent assurance heldone of ISO 27001 and a SOC 2 Type 2 — 100, One current certificate or report — 75, Certification in progress — 40, None — 0
One current certificate or report — 75
Security questionnaire scoreaccepts 0–100 %
72 %
Independent penetration test evidence provided
Yes
Subprocessors disclosed behind this vendoraccepts 0–500 subprocessors
6 subprocessors
Publicly known breach in the last three years
No

Results

Vendor Risk Verdict
Low — proceed with standard clauses and periodic review
Inherent Vendor Risk
3.50 of 5
Assurance Evidence Score
78.8%
Residual Vendor Risk
1.57 of 5
Share of the Maximum Score
31.4%
Reassessment Interval
24 months
Assessment Tier
Tier 2 — significant vendor: full questionnaire plus certificate or report review
Largest Assurance Gap
Assurance evidence is adequate for this tier

Step by step

  1. 1Values used
  2. 2Vendor Risk
  3. 3Assurance and residual
  4. 4Vendor Risk Verdict= Low — proceed with standard clauses and periodic review
  5. 5Inherent Vendor Risk= 3.50 of 5
  6. 6Assurance Evidence Score= 78.8
  7. 7Residual Vendor Risk= 1.57 of 5
  8. 8Share of the Maximum Score= 31.4
  9. 9Reassessment Interval= 24 months

Assumptions and limits

  • The result is derived only from the 9 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax or fees or charges into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Vendor Risk calculated?

Inherent vendor risk = 0.30 × data class + 0.25 × access type + 0.25 × operational criticality + 0.10 × spend band + 0.10 × subprocessor band, on 1–5. Tiering is driven by data and access rather than by spend, because a cheap tool with an API token in your production tenant outranks an expensive one that never touches your data. Assurance evidence is capped at 70% effectiveness since a certificate describes a scope you did not choose, at a date that has passed, and a questionnaire is only as good as the evidence behind the answers.

Why does Vendor Risk matter?

Vendor tiering decides how much diligence each supplier gets, and getting the tier wrong is how a low-spend integration ends up with unmonitored privileged access. This is a management estimate to prioritise diligence, not an assurance opinion on the vendor.

What values do I need to enter?

This calculator takes 9 inputs: Most sensitive data the vendor handles, Access the vendor holds, Criticality to your operations, Annual contract value, Independent assurance held, Security questionnaire score, Independent penetration test evidence provided, Subprocessors disclosed behind this vendor, Publicly known breach in the last three years. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Is a SOC 2 report enough on its own?

Only after you have read it. Check the scope, the trust services categories, the observation period and the exceptions — a report scoped to one product with a three-month window and four exceptions is not the assurance the cover page implies. The report answers questions about their controls, not about the service you are buying.

Why do subprocessors affect the score?

Because your data goes where they send it. Every subprocessor is a fourth party you have no contract with, and concentration behind several of your vendors — the same cloud region, the same email provider — creates correlated failures that vendor-by-vendor assessment never surfaces.

Related Calculators

Vendor Risk Calculator – Calculate Vendor Risk Verdict