
Vendor Due Diligence
- 71 installs
- 451 repo stars
- Updated July 21, 2026
- borghei/claude-skills
vendor-due-diligence is a Claude skill that assesses IT vendors with multi-factor risk scoring and regulatory compliance checklists.
About
Vendor-due-diligence assesses IT service providers and third-party partners with multi-factor risk scoring across 6 dimensions and regulatory compliance checklists. It runs a Three-Phase Assessment, compares vendors, and supports ongoing monitoring with early warning indicators. Procurement, legal, and security teams use it to evaluate technology vendors.
- Multi-factor vendor risk scoring across 6 dimensions with critical-service weighting
- Regulatory compliance checklists for 8 frameworks (GDPR, DORA, NIS2, SOX, PCI DSS, ISO 27001/SOC 2, HIPAA, FedRAMP)
- Three-Phase Assessment plus vendor comparison and ongoing monitoring
Vendor Due Diligence by the numbers
- 71 all-time installs (skills.sh)
- Ranked #1,170 of 2,203 Security skills by installs in the Skillselion catalog
- Data as of Aug 5, 2026 (Skillselion catalog sync)
vendor-due-diligence capabilities & compatibility
- Capabilities
- vendor risk scoring · compliance checklist · vendor comparison
- Use cases
- security audit · research · data analysis
- Pricing
- Free
What vendor-due-diligence says it does
Scores a vendor across 6 risk dimensions based on questionnaire responses.
regulatory compliance checklists for 8 frameworks
npx skills add https://github.com/borghei/claude-skills --skill vendor-due-diligenceAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 71 |
|---|---|
| repo stars | ★ 451 |
| Last updated | July 21, 2026 |
| Repository | borghei/claude-skills ↗ |
What it does
Assess and compare technology vendors with multi-dimensional risk scoring and regulatory compliance checklists.
Who is it for?
Procurement, legal, IT security, and compliance teams evaluating technology vendors.
Skip if: Situations needing formal legal advice (marked experimental) or non-vendor risk assessment.
When should I use this skill?
Evaluating a technology vendor or third-party partner for risk and compliance.
What you get
A weighted vendor risk score, compliance checklist results, and an approve/reject recommendation.
- vendor risk score
- compliance checklist
- vendor comparison matrix
By the numbers
- 6 risk dimensions
- 8 regulatory frameworks
- three-phase 20-day assessment
Files
⚠️ EXPERIMENTAL — This skill is provided for educational and informational purposes only. It does NOT constitute legal advice. All responsibility for usage rests with the user. Consult qualified legal professionals before acting on any output.
Vendor Due Diligence Skill
Overview
Production-ready framework for assessing IT service providers, technology vendors, and third-party partners. Provides a Three-Phase Assessment (Initial Screening, Detailed Assessment, Final Evaluation), Multi-Factor Risk Scoring across 6 dimensions with critical-service weighting, regulatory compliance checklists for 8 frameworks, vendor comparison matrices, and ongoing monitoring with Early Warning Indicators. Designed for procurement teams, legal counsel, IT security, and compliance officers evaluating technology vendors.
Table of Contents
- Tools
- Reference Guides
- Workflows
- Troubleshooting
- Success Criteria
- Scope & Limitations
- Anti-Patterns
- Tool Reference
Tools
1. Vendor Risk Scorer (scripts/vendor_risk_scorer.py)
Scores a vendor across 6 risk dimensions based on questionnaire responses. Calculates weighted composite score with 2x multiplier for critical services. Generates risk heat map and overall recommendation.
# Score a vendor from questionnaire responses
python scripts/vendor_risk_scorer.py vendor_responses.json
# JSON output for dashboards
python scripts/vendor_risk_scorer.py vendor_responses.json --json
# Flag as critical service (2x weight on security + compliance)
python scripts/vendor_risk_scorer.py vendor_responses.json --critical2. Vendor Comparison (scripts/vendor_comparison.py)
Takes multiple vendor risk assessment JSONs and generates a side-by-side comparison matrix. Ranks vendors by composite score and recommends preferred vendor with rationale.
# Compare two vendors
python scripts/vendor_comparison.py vendor_a.json vendor_b.json
# Compare multiple vendors with JSON output
python scripts/vendor_comparison.py vendor_a.json vendor_b.json vendor_c.json --json
# Compare with critical service weighting
python scripts/vendor_comparison.py vendor_a.json vendor_b.json --criticalReference Guides
| Reference | Purpose |
|---|---|
references/risk_assessment_framework.md | 6-dimension scoring system, weighting methodology, composite score interpretation |
references/regulatory_checklists.md | Pre-built compliance checklists for GDPR, DORA, NIS2, SOX, PCI DSS, ISO 27001/SOC 2, HIPAA, FedRAMP |
references/monitoring_framework.md | Quarterly reviews, Early Warning Indicators, KPI metrics, risk mitigation strategies, onboarding checklists |
Workflows
Workflow 1: Three-Phase Vendor Assessment
Phase 1: Initial Screening (Days 1-5) 1. Gather basic vendor information (company profile, financial health, certifications) 2. Run vendor_risk_scorer.py with preliminary data for initial risk classification 3. Check applicable regulatory frameworks from regulatory_checklists.md 4. Decision gate: Proceed to detailed assessment or reject early
Phase 2: Detailed Assessment (Days 5-15) 1. Issue comprehensive vendor questionnaire covering all 6 risk dimensions 2. Run vendor_risk_scorer.py with complete questionnaire responses 3. Execute regulatory compliance checklists for all applicable frameworks 4. Request supporting documentation (SOC 2 reports, pen test results, financials) 5. Conduct reference checks and public record searches
Phase 3: Final Evaluation (Days 15-20) 1. Run vendor_comparison.py if evaluating multiple vendors 2. Compile Vendor Risk Report with dimension breakdowns 3. Document gaps and required mitigations from risk_assessment_framework.md 4. Present recommendation (Approve / Approve with Conditions / Reject) 5. If approved, generate onboarding checklist from monitoring_framework.md
Workflow 2: Competitive Vendor Selection
1. Define requirements -- Document must-have and nice-to-have criteria mapped to risk dimensions 2. Screen candidates -- Run initial scoring on all candidates; eliminate any with Critical risk 3. Deep-dive finalists -- Full 6-dimension assessment on top 2-3 vendors 4. Compare -- Run vendor_comparison.py on finalist assessments 5. Negotiate -- Use risk findings as leverage in contract negotiations (integrates with tech-contract-negotiation skill) 6. Select and onboard -- Approve preferred vendor; set up monitoring per monitoring_framework.md
Workflow 3: Ongoing Vendor Monitoring
1. Quarterly review -- Re-score vendor using updated data; compare against baseline 2. Event-triggered review -- Re-assess on M&A, breaches, regulatory changes, or leadership turnover 3. Annual re-assessment -- Full 6-dimension re-evaluation with updated questionnaire 4. Early Warning response -- Monitor indicators from monitoring_framework.md; escalate per defined paths 5. Exit planning -- If risk exceeds threshold, activate exit provisions and dual-source strategy
Troubleshooting
| Problem | Cause | Solution |
|---|---|---|
| All dimensions score 1 (Low Risk) | Vendor self-reported optimistically on questionnaire | Cross-reference with SOC 2 reports, pen test results, and financial filings; adjust scores based on evidence |
| Composite score doesn't reflect known security issues | Security dimension not weighted for critical service | Re-run with --critical flag to apply 2x multiplier on security and compliance dimensions |
| Comparison matrix shows all vendors tied | Scoring inputs are too similar or too coarse | Request more granular data; use the 5-level scoring criteria from the risk framework to differentiate |
| Regulatory checklist seems incomplete for your industry | Only 8 frameworks are pre-built | Customize checklists by adding industry-specific requirements as additional items |
| Vendor refuses to complete questionnaire | Vendor sees assessment as overly burdensome | Share only the dimensions relevant to their service scope; offer to accept SOC 2/ISO 27001 reports as partial substitutes |
| Risk score changed dramatically between quarters | Major event occurred (breach, M&A, leadership change) | This is expected behavior; document the trigger event and follow the event-triggered review process |
Success Criteria
- Assessment Completeness: 100% of vendor assessments cover all 6 risk dimensions with evidence-backed scores
- Timeline Adherence: Three-phase assessment completed within 20 business days for 90% of evaluations
- Risk Prediction Accuracy: Vendors flagged as High/Critical risk experience 3x more incidents than Low risk vendors over 12 months
- Regulatory Coverage: All applicable regulatory checklists completed with zero missed frameworks for 95% of assessments
- Comparison Consistency: Vendor comparison rankings remain stable when re-scored by different assessors (inter-rater reliability > 85%)
- Monitoring Compliance: 100% of quarterly reviews completed on schedule with documented findings
- Early Warning Detection: 80%+ of vendor incidents preceded by at least one Early Warning Indicator flagged in monitoring
Scope & Limitations
This skill covers:
- Multi-factor risk scoring across 6 dimensions (Financial, Operational, Compliance, Security, Reputational, Strategic) with critical-service weighting
- Regulatory compliance checklists for GDPR, DORA, NIS2, SOX, PCI DSS, ISO 27001/SOC 2, HIPAA, and FedRAMP
- Side-by-side vendor comparison with composite ranking and dimension-level analysis
- Ongoing monitoring framework with quarterly reviews, Early Warning Indicators, and escalation paths
- Risk mitigation strategies and onboarding checklists by risk level
This skill does NOT cover:
- Real-time vendor monitoring dashboards, automated data feeds, or integration with GRC platforms (all input is via JSON files)
- Financial auditing, forensic accounting, or detailed financial statement analysis of vendors (use the
finance/financial-analystskill) - Physical security assessments, on-site facility audits, or hardware supply chain verification
- Legal review of vendor contracts or negotiation of terms (use the
legal/tech-contract-negotiationskill) - Vendor relationship management, performance optimization, or strategic partnership development beyond risk assessment
Anti-Patterns
| Anti-Pattern | Why It Fails | Better Approach |
|---|---|---|
| Relying solely on vendor self-assessment questionnaires | Vendors underreport risks; no independent verification | Cross-reference questionnaire responses with SOC 2/ISO 27001 reports, pen test results, and public records |
| Applying the same weight to all dimensions regardless of service type | A payroll vendor and a marketing tool have different risk profiles | Use --critical flag for critical services; adjust dimension weights based on service classification |
| Completing due diligence once and never revisiting | Vendor risk changes over time due to M&A, breaches, market shifts | Implement quarterly monitoring with annual re-assessment per the monitoring framework |
| Rejecting vendors for a single high-risk dimension without considering mitigations | Eliminates potentially strong vendors with addressable gaps | Use the gap analysis severity classification; require remediation plans for major concerns before final decision |
| Skipping the comparison matrix for sole-source procurements | Misses opportunity to benchmark the vendor against market standards | Run comparison against industry benchmarks or previous vendor assessments to establish a risk baseline |
Tool Reference
scripts/vendor_risk_scorer.py
Score a vendor across 6 risk dimensions and generate an overall recommendation.
usage: vendor_risk_scorer.py [-h] [--json] [--critical]
input_file
positional arguments:
input_file Path to JSON file with vendor questionnaire responses
options:
-h, --help Show help message and exit
--json Output results as JSON
--critical Apply 2x weight to security and compliance
dimensions (for critical/essential services)Outputs: 6-dimension risk scores (1-5 each), weighted composite score, risk level classification (Low/Moderate/High/Critical), overall recommendation (Approve/Approve with Conditions/Reject), dimension-level findings, and gap analysis.
scripts/vendor_comparison.py
Compare multiple vendors side-by-side and recommend preferred vendor.
usage: vendor_comparison.py [-h] [--json] [--critical]
input_files [input_files ...]
positional arguments:
input_files Paths to vendor assessment JSON files (minimum 2)
options:
-h, --help Show help message and exit
--json Output results as JSON
--critical Apply 2x weight to security and compliance
dimensions (for critical/essential services)Outputs: Side-by-side comparison matrix, composite score ranking, per-dimension strength/weakness analysis, preferred vendor recommendation with rationale, and risk delta highlights.
Vendor Monitoring Framework
Ongoing vendor monitoring including quarterly reviews, annual re-assessments, event-triggered reviews, Early Warning Indicators, KPI metrics, risk mitigation strategies, and onboarding checklists.
Table of Contents
- Monitoring Overview
- Quarterly Review Template
- Annual Re-Assessment Framework
- Event-Triggered Reviews
- Early Warning Indicators
- KPI Dashboard Metrics
- Risk Mitigation Strategies
- Onboarding Checklist
Monitoring Overview
Vendor monitoring operates on three cycles with escalating depth of review.
| Cycle | Frequency | Depth | Trigger |
|---|---|---|---|
| Quarterly Review | Every 3 months | Operational metrics, SLA performance, incident review | Calendar-based |
| Annual Re-Assessment | Every 12 months | Full 6-dimension risk re-scoring with updated questionnaire | Calendar-based |
| Event-Triggered Review | As needed | Targeted assessment of impacted dimensions | Specific event occurs |
Risk-Based Monitoring Intensity
| Vendor Risk Level | Quarterly Review | Annual Re-Assessment | Monitoring Intensity |
|---|---|---|---|
| Low Risk (1.0-1.5) | Abbreviated (metrics only) | Standard questionnaire | Routine |
| Moderate Risk (1.6-2.5) | Standard (metrics + discussion) | Full questionnaire + evidence review | Enhanced |
| High Risk (2.6-3.5) | Extended (deep-dive + remediation tracking) | Full questionnaire + on-site/virtual audit | Active |
| Critical Risk (3.6-5.0) | Monthly review | Quarterly re-assessment | Intensive |
Quarterly Review Template
Review Agenda
| # | Item | Time | Owner |
|---|---|---|---|
| 1 | SLA performance review | 15 min | Vendor |
| 2 | Incident summary (count, severity, resolution time) | 10 min | Vendor |
| 3 | Change and release summary | 10 min | Vendor |
| 4 | Compliance and certification updates | 5 min | Vendor |
| 5 | Upcoming changes or risks | 5 min | Vendor |
| 6 | Client feedback and escalations | 10 min | Client |
| 7 | Action items and next steps | 5 min | Both |
Metrics to Review
| Category | Metric | Target | Red Flag |
|---|---|---|---|
| Availability | Uptime % | Per SLA (e.g., 99.9%) | Below SLA for 2+ months |
| Performance | Response time (P95) | Per SLA | Degrading trend over 3 months |
| Incidents | P1/P2 count | Decreasing trend | Increasing P1s; recurring issues |
| Incidents | Mean time to resolve (MTTR) | Per SLA | MTTR increasing; SLA breaches |
| Security | Vulnerability count (critical/high) | Zero critical open > 30 days | Any critical open > 30 days |
| Security | Security incidents | Zero | Any data-related security incident |
| Compliance | Certification status | Current | Certification lapsed or expiring < 90 days |
| Financial | Invoice accuracy | > 99% | Recurring billing disputes |
| Support | Ticket resolution rate | > 95% within SLA | Below 90%; escalations increasing |
Review Output
Document the following after each quarterly review:
| Output | Content |
|---|---|
| Performance summary | SLA compliance, incident trends, key metrics |
| Issues log | Open issues with severity, owner, and target resolution date |
| Risk update | Any changes to the vendor's risk profile |
| Action items | Specific actions with owners and due dates |
| Next review date | Confirmed date for next quarterly review |
Annual Re-Assessment Framework
Process
| Step | Activity | Timeline |
|---|---|---|
| 1 | Issue updated vendor questionnaire (all 6 dimensions) | 4 weeks before review |
| 2 | Collect and review evidence (certifications, audit reports, financials) | 3 weeks before review |
| 3 | Re-score using vendor risk scoring tool | 2 weeks before review |
| 4 | Compare scores against prior year baseline | 2 weeks before review |
| 5 | Conduct annual review meeting | Review date |
| 6 | Document findings and update risk register | 1 week after review |
| 7 | Issue remediation requirements if applicable | 1 week after review |
Year-over-Year Comparison
| Dimension | Prior Year Score | Current Score | Change | Trend |
|---|---|---|---|---|
| Financial | - | - | - | Improving / Stable / Deteriorating |
| Operational | - | - | - | Improving / Stable / Deteriorating |
| Compliance | - | - | - | Improving / Stable / Deteriorating |
| Security | - | - | - | Improving / Stable / Deteriorating |
| Reputational | - | - | - | Improving / Stable / Deteriorating |
| Strategic | - | - | - | Improving / Stable / Deteriorating |
| Composite | - | - | - | - |
Escalation Criteria
| Condition | Action |
|---|---|
| Composite score increased by > 0.5 | Escalate to risk committee; increase monitoring frequency |
| Any dimension increased to 4 or 5 | Require remediation plan within 30 days |
| Composite score now > 3.5 | Activate exit planning; engage alternative vendors |
| Compliance dimension increased by 2+ | Immediate regulatory impact assessment |
Event-Triggered Reviews
Trigger Events
| Event | Review Scope | Timeline | Escalation |
|---|---|---|---|
| Data breach at vendor | Security, Compliance, Reputational | Within 48 hours | Immediate executive notification |
| Vendor M&A announcement | All dimensions (full re-assessment) | Within 2 weeks | Risk committee review |
| Regulatory violation or sanction | Compliance, Reputational | Within 1 week | Legal and compliance team engagement |
| Key leadership change (CEO, CTO, CISO) | Operational, Strategic | Within 2 weeks | Relationship manager assessment |
| Financial deterioration (downgrade, layoffs, losses) | Financial, Operational, Strategic | Within 1 week | Financial analysis; exit readiness check |
| Major service outage (> SLA threshold) | Operational, Security | Within 48 hours | SLA remediation process |
| Vendor loses certification | Compliance, Security | Within 1 week | Impact assessment; remediation timeline |
| Significant negative press | Reputational | Within 1 week | Communications and legal review |
| Sub-processor change for critical service | Compliance, Security, Operational | Within 2 weeks | Sub-processor assessment |
| Your own regulatory change | Compliance | Within 4 weeks | Gap analysis against new requirements |
Event Response Process
1. Identify -- Capture the event through monitoring channels, news alerts, or vendor notification 2. Assess -- Determine which risk dimensions are impacted and the potential severity 3. Investigate -- Gather information from vendor and independent sources 4. Score -- Re-score impacted dimensions using the risk assessment framework 5. Decide -- Determine action: continue monitoring, require remediation, escalate, or activate exit 6. Document -- Record the event, assessment, decision, and rationale in the vendor risk register
Early Warning Indicators
Indicators that suggest vendor risk may be increasing before a formal trigger event occurs.
Financial Early Warnings
| Indicator | Detection Method | Severity |
|---|---|---|
| Late payments to their own suppliers | Industry intelligence, credit monitoring | Moderate |
| Cost-cutting announcements (layoffs > 10%) | News monitoring, LinkedIn | High |
| Failed funding round or down round | Crunchbase, news | High |
| Credit rating downgrade | Credit monitoring services | High |
| Loss of major client (> 10% revenue) | News, industry contacts | Moderate |
| Delayed financial reporting | Quarterly check-in; SEC filings | Moderate |
Operational Early Warnings
| Indicator | Detection Method | Severity |
|---|---|---|
| Key personnel departures (CISO, CTO, VP Eng) | LinkedIn monitoring, vendor notification | High |
| Increasing support ticket volume | Quarterly metrics review | Moderate |
| Degrading SLA performance (trend, not one-off) | Monthly SLA dashboards | Moderate |
| Delayed product releases or roadmap changes | Vendor communications, product updates | Low |
| Increased employee turnover (Glassdoor, LinkedIn) | External monitoring | Moderate |
Security Early Warnings
| Indicator | Detection Method | Severity |
|---|---|---|
| Certification expiring without renewal plans | Certificate monitoring; quarterly review | High |
| Increased vulnerability disclosures in vendor product | CVE monitoring, security advisories | Moderate-High |
| Vendor appears in breach databases or threat intelligence | Threat intelligence feeds | Critical |
| Delayed patch releases for known vulnerabilities | Security advisory monitoring | High |
| Changes to vendor security team (reductions) | LinkedIn monitoring | Moderate |
Escalation Path
| Severity | Response Time | Escalation To | Action |
|---|---|---|---|
| Low | Next quarterly review | Relationship manager | Note and monitor |
| Moderate | Within 2 weeks | Vendor risk owner | Investigate; request vendor response |
| High | Within 1 week | Risk committee / management | Formal assessment; remediation demand |
| Critical | Within 48 hours | Executive leadership; legal | Incident response; potential exit activation |
KPI Dashboard Metrics
Vendor Performance KPIs
| KPI | Formula | Target | Frequency |
|---|---|---|---|
| SLA Compliance Rate | Months meeting SLA / Total months | > 95% | Monthly |
| Incident Rate | P1+P2 incidents / Month | Decreasing trend | Monthly |
| Mean Time to Resolve (P1) | Average P1 resolution time | Per SLA | Monthly |
| Service Credit Utilization | Credits claimed / Credits available | < 20% | Quarterly |
| Vendor Responsiveness | Requests responded within SLA / Total requests | > 95% | Monthly |
Vendor Risk KPIs
| KPI | Formula | Target | Frequency |
|---|---|---|---|
| Composite Risk Score | Weighted average of 6 dimensions | < 2.5 | Quarterly |
| Risk Trend | Current score - Prior quarter score | Stable or improving | Quarterly |
| Open Gaps Count | Active gaps from gap analysis | Decreasing | Quarterly |
| Gap Closure Rate | Gaps closed on time / Gaps due | > 90% | Quarterly |
| Early Warning Count | Active early warning indicators | Zero High/Critical | Monthly |
Portfolio-Level KPIs
| KPI | Formula | Target | Frequency |
|---|---|---|---|
| Vendor Portfolio Risk | Average composite score across all vendors | < 2.0 | Quarterly |
| High-Risk Vendor % | Vendors scoring > 3.0 / Total vendors | < 10% | Quarterly |
| Assessment Completion Rate | Assessments completed on time / Assessments due | 100% | Quarterly |
| Monitoring Compliance | Reviews completed on schedule / Reviews due | 100% | Quarterly |
Risk Mitigation Strategies
Specific mitigation strategies organized by risk dimension.
Financial Risk Mitigations
| Mitigation | When to Apply | Implementation |
|---|---|---|
| Parent company guarantee | Vendor is subsidiary; financial risk is moderate+ | Require parent guarantee in contract |
| Performance bond | High-value contract; vendor financial risk is high | Bond covering 6-12 months of fees |
| Insurance requirements | All vendors; scale with risk level | Minimum coverage amounts in contract |
| Escrow (fees) | Vendor financial risk is high; critical service | Escrow 3-6 months of fees |
| Shorter contract terms | Financial uncertainty; limit exposure | 12-month terms with renewal option |
| Payment milestones | Project-based work; financial risk is moderate+ | Pay on delivery/acceptance, not upfront |
Security Risk Mitigations
| Mitigation | When to Apply | Implementation |
|---|---|---|
| Mandatory security controls | All vendors processing your data | Contractual security schedule |
| Annual penetration testing | Moderate+ security risk | Contractual requirement; share results |
| Enhanced monitoring | High security risk | Real-time alerting; dedicated security contact |
| Data minimization | All vendors; reduce blast radius | Limit data shared to minimum necessary |
| Encryption requirements | All vendors handling sensitive data | Contractual encryption standards |
| Incident response SLA | All vendors; stricter for higher risk | 24-hour notification; joint IR exercises |
Compliance Risk Mitigations
| Mitigation | When to Apply | Implementation |
|---|---|---|
| Certification timeline | Vendor lacks required certifications | Contractual commitment with milestone dates |
| Audit rights | All vendors; frequency based on risk | Annual audit right; accept SOC 2 as alternative |
| Breach termination clause | All vendors | Right to terminate for material compliance breach |
| Regulatory change clause | Regulated industries | Vendor must accommodate new regulatory requirements |
| Compliance reporting | Moderate+ compliance risk | Quarterly compliance status reports |
| Sub-processor controls | GDPR/DORA applicable vendors | Approval rights for sub-processor changes |
Operational Risk Mitigations
| Mitigation | When to Apply | Implementation |
|---|---|---|
| SLAs with financial consequences | All vendors with availability requirements | Service credits; termination rights |
| Redundancy requirements | Critical services | Contractual geographic/infrastructure redundancy |
| IP escrow | Vendor-dependent technology; high operational risk | Source code escrow with release triggers |
| Backup vendor identification | Critical services; high operational risk | Identify and pre-qualify alternative vendor |
| Knowledge transfer | Key-person dependency identified | Documented knowledge transfer plan |
| Transition assistance | All vendors | Contractual transition assistance obligation on termination |
Strategic Risk Mitigations
| Mitigation | When to Apply | Implementation |
|---|---|---|
| Limited contract terms | High lock-in risk | Maximum 2-3 year terms with exit provisions |
| Data portability testing | All vendors | Annual data export test |
| Dual-source strategy | Critical services; high strategic risk | Maintain qualified alternative vendor |
| Exit provisions | All vendors | Documented exit plan with timeline and vendor obligations |
| API/integration standards | Technology vendors | Require open standards; avoid proprietary lock-in |
| Innovation requirements | Strategic vendors; long-term relationships | Contractual innovation/roadmap sharing commitments |
Onboarding Checklist
Post-approval vendor onboarding tasks, scaled by risk level.
All Vendors (Baseline)
| # | Task | Owner | Timeline |
|---|---|---|---|
| 1 | Execute contract with all required provisions | Legal | Before start |
| 2 | Add vendor to vendor register/inventory | Procurement | Day 1 |
| 3 | Set up access and credentials (least privilege) | IT Security | Day 1-3 |
| 4 | Confirm data handling procedures | Data Protection | Week 1 |
| 5 | Establish communication channels and escalation contacts | Relationship Mgr | Week 1 |
| 6 | Schedule first quarterly review | Relationship Mgr | Week 1 |
| 7 | Document vendor in risk register with baseline score | Risk/Compliance | Week 1 |
| 8 | Configure monitoring alerts (SLA, incidents) | Operations | Week 1-2 |
Moderate Risk Vendors (Additional)
| # | Task | Owner | Timeline |
|---|---|---|---|
| 9 | Document gap remediation plan with milestones | Risk/Compliance | Week 2 |
| 10 | Set up enhanced SLA monitoring dashboard | Operations | Week 2 |
| 11 | Confirm insurance certificates on file | Procurement | Week 1 |
| 12 | Brief internal stakeholders on vendor risk profile | Relationship Mgr | Week 2 |
High/Critical Risk Vendors (Additional)
| # | Task | Owner | Timeline |
|---|---|---|---|
| 13 | Assign dedicated vendor risk owner | Risk Committee | Before start |
| 14 | Execute detailed exit/transition plan | Legal + Operations | Month 1 |
| 15 | Set up monthly (not quarterly) review cadence | Relationship Mgr | Week 1 |
| 16 | Identify and pre-qualify backup vendor | Procurement | Month 1-2 |
| 17 | Configure Early Warning Indicator monitoring | Risk/Compliance | Week 2 |
| 18 | Schedule tabletop incident response exercise with vendor | Security | Quarter 1 |
| 19 | Obtain executive risk acceptance sign-off | Risk Committee | Before start |
| 20 | Set up financial health monitoring for vendor | Finance | Week 2 |
Vendor Regulatory Compliance Checklists
Pre-built compliance checklist templates for 8 regulatory frameworks. Each checklist covers key requirements, assessment questions, and gap analysis prompts for vendor due diligence.
Table of Contents
- How to Use These Checklists
- 1. GDPR (General Data Protection Regulation)
- 2. DORA (Digital Operational Resilience Act)
- 3. NIS2 (Network and Information Security Directive)
- 4. SOX (Sarbanes-Oxley Act)
- 5. PCI DSS (Payment Card Industry Data Security Standard)
- 6. ISO 27001 / SOC 2
- 7. HIPAA (Health Insurance Portability and Accountability Act)
- 8. FedRAMP (Federal Risk and Authorization Management Program)
- Cross-Framework Gap Analysis
How to Use These Checklists
1. Identify which frameworks apply to your vendor relationship based on your industry, data types, and jurisdictions 2. Issue the relevant checklists as part of the vendor questionnaire 3. Score each item as: Compliant / Partially Compliant / Non-Compliant / Not Applicable 4. Use the gap analysis prompts to investigate non-compliant or partially compliant items 5. Feed results into the vendor risk scoring tool for the Compliance dimension
1. GDPR (General Data Protection Regulation)
Applies when: Vendor processes personal data of EU/EEA residents on your behalf.
| # | Requirement | Assessment Question | Evidence Required |
|---|---|---|---|
| 1 | Data Processing Agreement | Does vendor have a GDPR-compliant DPA template or accept yours? | Signed DPA or template |
| 2 | Lawful basis for processing | Can vendor confirm processing is limited to your documented instructions? | DPA Art. 28 provisions |
| 3 | Sub-processor management | Does vendor maintain a list of sub-processors with notification process? | Sub-processor list; notification mechanism |
| 4 | Data breach notification | Can vendor notify you of personal data breaches within 72 hours? | Incident response plan; breach notification SLA |
| 5 | Data subject rights support | Can vendor assist with DSAR fulfillment (access, deletion, portability)? | DSAR process documentation |
| 6 | International data transfers | If data leaves EEA, what transfer mechanism is used (SCCs, adequacy)? | SCCs; Transfer Impact Assessment |
| 7 | Data deletion/return | Will vendor delete or return all personal data upon contract termination? | Data retention/deletion policy |
| 8 | Records of processing | Does vendor maintain records of processing activities per Art. 30? | ROPA documentation |
| 9 | DPIA support | Can vendor provide information needed for Data Protection Impact Assessments? | DPIA contribution process |
| 10 | DPO designation | Has vendor appointed a DPO where required? | DPO contact details |
Gap Analysis Prompts:
- If no DPA: Is vendor willing to negotiate one? What is timeline?
- If no sub-processor list: How does vendor manage sub-processing today?
- If data transfers outside EEA: Are Standard Contractual Clauses current (post-Schrems II)?
2. DORA (Digital Operational Resilience Act)
Applies when: You are a financial entity (bank, insurer, investment firm) engaging an ICT third-party service provider.
| # | Requirement | Assessment Question | Evidence Required |
|---|---|---|---|
| 1 | ICT risk management | Does vendor have an ICT risk management framework? | ICT risk policy documentation |
| 2 | Incident classification and reporting | Can vendor classify and report ICT-related incidents per DORA taxonomy? | Incident classification matrix; reporting SLA |
| 3 | Digital operational resilience testing | Does vendor participate in or conduct threat-led penetration testing (TLPT)? | TLPT reports; testing schedule |
| 4 | Third-party risk provisions | Does vendor's contract include all DORA Art. 28 required provisions? | Contract clause mapping to DORA Art. 28 |
| 5 | Exit strategy | Has vendor documented an exit strategy and transition plan? | Exit plan; data portability assessment |
| 6 | Sub-outsourcing controls | Does vendor notify and obtain consent for material sub-outsourcing? | Sub-outsourcing policy and register |
| 7 | Audit and inspection rights | Will vendor provide audit access as required by DORA? | Contractual audit clause; pooled audit option |
| 8 | Business continuity | Does vendor test business continuity and disaster recovery annually? | BCP/DR test results; recovery time objectives |
| 9 | Concentration risk | Does vendor's market position create concentration risk? | Market share data; alternative provider assessment |
| 10 | Regulatory access | Will vendor facilitate direct access by your financial regulator? | Contractual regulatory access clause |
Gap Analysis Prompts:
- If no exit plan: What data formats and migration support does vendor provide?
- If no TLPT: What alternative security testing does vendor conduct?
- If audit access refused: Will vendor accept pooled audit arrangement?
3. NIS2 (Network and Information Security Directive)
Applies when: You are an essential or important entity under NIS2 and the vendor is part of your supply chain.
| # | Requirement | Assessment Question | Evidence Required |
|---|---|---|---|
| 1 | Risk analysis and security policies | Does vendor maintain documented information security policies? | Security policy suite |
| 2 | Incident handling | Does vendor have an incident response plan with defined reporting timelines? | IR plan; 24-hour early warning capability |
| 3 | Business continuity | Does vendor maintain backup management, disaster recovery, and crisis management? | BCP/DR documentation and test results |
| 4 | Supply chain security | Does vendor assess and manage their own supply chain security? | Third-party risk management program |
| 5 | Vulnerability handling | Does vendor have a vulnerability disclosure and patching program? | Vulnerability management policy; patch SLAs |
| 6 | Cybersecurity hygiene | Does vendor enforce basic cybersecurity practices (training, patching, access control)? | Training records; patch compliance metrics |
| 7 | Cryptography and encryption | Does vendor use appropriate encryption and cryptographic controls? | Encryption standards documentation |
| 8 | Access control | Does vendor enforce multi-factor authentication and role-based access? | Access control policy; MFA implementation evidence |
| 9 | Asset management | Does vendor maintain an inventory of network and information systems? | Asset inventory; configuration management |
| 10 | Security assessment | Does vendor conduct regular security effectiveness assessments? | Audit reports; security metrics |
Gap Analysis Prompts:
- If no supply chain program: How does vendor select and monitor their own suppliers?
- If no vulnerability program: What is vendor's mean time to patch critical vulnerabilities?
- If no MFA: What compensating controls protect access to your data?
4. SOX (Sarbanes-Oxley Act)
Applies when: Vendor processes, stores, or transmits financial data that affects your financial reporting.
| # | Requirement | Assessment Question | Evidence Required |
|---|---|---|---|
| 1 | Internal controls | Does vendor maintain internal controls over processes affecting your financial data? | SOC 1 Type II report; ICFR documentation |
| 2 | Audit trails | Does vendor maintain immutable audit trails for all financial data transactions? | Audit log architecture; retention policy |
| 3 | Segregation of duties | Does vendor enforce segregation of duties for financial processes? | SoD matrix; access control documentation |
| 4 | Change management | Does vendor have formal change management for systems processing financial data? | Change management policy; CAB process |
| 5 | Access controls | Does vendor restrict access to financial data based on least-privilege? | Access review reports; RBAC documentation |
| 6 | Data integrity | Does vendor ensure completeness and accuracy of financial data processing? | Reconciliation procedures; data validation |
| 7 | Backup and recovery | Can vendor recover financial data to a known good state? | Backup policy; recovery test results |
| 8 | Audit cooperation | Will vendor cooperate with your external auditors? | Contractual audit clause; auditor access |
Gap Analysis Prompts:
- If no SOC 1: Can vendor obtain SOC 1 Type II within 12 months?
- If no audit trails: How can you demonstrate data integrity to your auditors?
- If limited SoD: What compensating controls exist?
5. PCI DSS (Payment Card Industry Data Security Standard)
Applies when: Vendor processes, stores, or transmits cardholder data.
| # | Requirement | Assessment Question | Evidence Required |
|---|---|---|---|
| 1 | Network security | Does vendor maintain secure network architecture (firewalls, segmentation)? | Network diagrams; firewall rules review |
| 2 | Cardholder data protection | Does vendor encrypt stored cardholder data? Is PAN masked in displays? | Encryption documentation; data flow diagrams |
| 3 | Vulnerability management | Does vendor maintain anti-malware and patch management programs? | AV deployment; patch compliance reports |
| 4 | Access control | Does vendor restrict access to cardholder data on need-to-know basis? | Access control policy; review reports |
| 5 | Network monitoring | Does vendor monitor and test networks regularly? | IDS/IPS deployment; network scan results |
| 6 | Security policy | Does vendor maintain a comprehensive information security policy? | Security policy suite; employee acknowledgments |
| 7 | PCI DSS validation | What level of PCI DSS compliance has vendor achieved? | AOC (Attestation of Compliance); ROC or SAQ |
| 8 | Incident response | Does vendor have a PCI-specific incident response plan? | IR plan; notification procedures for card brands |
| 9 | Tokenization/encryption | Does vendor use tokenization or point-to-point encryption to reduce scope? | Tokenization architecture; P2PE validation |
| 10 | Third-party management | Does vendor assess PCI compliance of their own service providers? | Third-party compliance program |
Gap Analysis Prompts:
- If no AOC: What is the timeline for PCI DSS validation?
- If cardholder data is not tokenized: What scope reduction measures are in place?
- If no network segmentation: How is cardholder data environment isolated?
6. ISO 27001 / SOC 2
Applies when: You require independent assurance of the vendor's information security controls.
| # | Requirement | Assessment Question | Evidence Required |
|---|---|---|---|
| 1 | ISMS / Security program | Does vendor maintain a formal Information Security Management System? | ISO 27001 certificate or SOC 2 Type II report |
| 2 | Risk assessment | Does vendor conduct regular information security risk assessments? | Risk assessment methodology; most recent results |
| 3 | Control implementation | Are controls mapped to ISO 27001 Annex A or SOC 2 Trust Service Criteria? | Statement of Applicability or SOC 2 control matrix |
| 4 | Internal audit | Does vendor conduct internal audits of their ISMS? | Internal audit schedule and findings |
| 5 | Management review | Does leadership review the security program regularly? | Management review minutes; security KPIs |
| 6 | Continuous improvement | Does vendor track and remediate audit findings? | Corrective action register; finding closure rates |
| 7 | Certification/attestation currency | Is the ISO 27001 certificate or SOC 2 report current (within 12 months)? | Certificate dates; SOC 2 report period |
| 8 | Scope adequacy | Does the certification scope cover the services provided to you? | Scope statement; service mapping |
| 9 | Exception management | How does vendor handle control exceptions? | Exception process; compensating controls |
| 10 | Incident metrics | Does vendor track and report security incident metrics? | Incident dashboard; trend analysis |
Gap Analysis Prompts:
- If certification scope doesn't cover your services: What controls apply outside the certified scope?
- If SOC 2 Type I only: What is timeline for Type II?
- If exceptions exist: Are compensating controls documented and tested?
7. HIPAA (Health Insurance Portability and Accountability Act)
Applies when: Vendor will create, receive, maintain, or transmit Protected Health Information (PHI) on your behalf.
| # | Requirement | Assessment Question | Evidence Required |
|---|---|---|---|
| 1 | Business Associate Agreement | Will vendor execute a BAA meeting HIPAA requirements? | Signed BAA or BAA template |
| 2 | PHI safeguards (administrative) | Does vendor have administrative safeguards for PHI? | Security policies; workforce training records |
| 3 | PHI safeguards (physical) | Does vendor have physical safeguards for PHI? | Facility access controls; workstation policies |
| 4 | PHI safeguards (technical) | Does vendor have technical safeguards for PHI? | Access controls; encryption; audit controls |
| 5 | Breach notification | Can vendor notify you of PHI breaches within required timeframe? | Breach notification procedures; SLA |
| 6 | Minimum necessary standard | Does vendor limit PHI access to minimum necessary for the service? | Data minimization practices; access controls |
| 7 | Sub-contractor management | Does vendor ensure sub-contractors also comply with HIPAA? | Sub-contractor BAAs; oversight program |
| 8 | Risk analysis | Has vendor conducted a HIPAA-specific risk analysis? | Risk analysis report; remediation plan |
| 9 | Disposal | Does vendor properly dispose of PHI when no longer needed? | Data disposal procedures; certificate of destruction |
| 10 | Audit trail | Does vendor maintain audit trails for PHI access and modifications? | Audit log configuration; retention policy |
Gap Analysis Prompts:
- If no BAA: Is vendor willing to execute one? What is timeline?
- If no HIPAA risk analysis: How does vendor assess PHI-related risks?
- If sub-contractors handle PHI: Are downstream BAAs in place?
8. FedRAMP (Federal Risk and Authorization Management Program)
Applies when: Vendor provides cloud services to U.S. federal agencies or processes federal data.
| # | Requirement | Assessment Question | Evidence Required |
|---|---|---|---|
| 1 | Authorization status | Has vendor achieved FedRAMP authorization (JAB or Agency)? | FedRAMP authorization letter; marketplace listing |
| 2 | Impact level | At what impact level is vendor authorized (Low, Moderate, High)? | Authorization boundary documentation |
| 3 | Continuous monitoring | Does vendor maintain a continuous monitoring program? | ConMon plan; monthly vulnerability scans; POA&M |
| 4 | Incident response | Does vendor meet FedRAMP incident response requirements (US-CERT reporting)? | IR plan; US-CERT reporting procedures |
| 5 | System security plan | Does vendor maintain a current SSP? | System Security Plan; date of last update |
| 6 | Annual assessment | Does vendor undergo annual third-party assessment (3PAO)? | 3PAO assessment reports; date of last assessment |
| 7 | POA&M management | Does vendor maintain and remediate Plan of Action & Milestones? | POA&M register; remediation timelines |
| 8 | Supply chain risk | Does vendor assess supply chain risks per NIST 800-161? | Supply chain risk management plan |
| 9 | Data sovereignty | Is all federal data stored within the United States? | Data residency documentation |
| 10 | Encryption (FIPS 140-2) | Does vendor use FIPS 140-2 validated cryptographic modules? | FIPS certificates; encryption architecture |
Gap Analysis Prompts:
- If no FedRAMP authorization: What is the timeline and sponsoring agency?
- If authorization is at Low impact: Does your use case require Moderate or High?
- If POA&M items are overdue: What is the remediation plan?
Cross-Framework Gap Analysis
When multiple frameworks apply, use this matrix to identify overlapping requirements and consolidated gaps.
| Requirement Area | GDPR | DORA | NIS2 | SOX | PCI DSS | ISO/SOC | HIPAA | FedRAMP |
|---|---|---|---|---|---|---|---|---|
| Encryption | Yes | Yes | Yes | - | Yes | Yes | Yes | Yes |
| Access control | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| Incident response | Yes | Yes | Yes | - | Yes | Yes | Yes | Yes |
| Audit rights | Yes | Yes | - | Yes | - | Yes | - | Yes |
| Data deletion | Yes | - | - | - | - | - | Yes | - |
| Business continuity | - | Yes | Yes | - | - | Yes | - | Yes |
| Vulnerability mgmt | - | Yes | Yes | - | Yes | Yes | - | Yes |
| Third-party risk | Yes | Yes | Yes | - | Yes | Yes | Yes | Yes |
| Breach notification | Yes | Yes | Yes | - | Yes | - | Yes | Yes |
| Change management | - | - | - | Yes | Yes | Yes | - | Yes |
Consolidation approach: If a vendor is compliant with the most stringent applicable framework, they likely satisfy the overlapping requirements of less stringent ones. ISO 27001 + SOC 2 Type II provides the broadest baseline coverage.
Vendor Risk Assessment Framework
Complete 6-dimension risk scoring system with detailed scoring criteria, weighting methodology, composite score interpretation, and gap analysis severity classification.
Table of Contents
- Framework Overview
- Dimension 1: Financial Risk
- Dimension 2: Operational Risk
- Dimension 3: Compliance Risk
- Dimension 4: Security Risk
- Dimension 5: Reputational Risk
- Dimension 6: Strategic Risk
- Weighting Methodology
- Composite Score Interpretation
- Gap Analysis
Framework Overview
The framework assesses vendors across 6 risk dimensions on a 1-5 scale. Lower scores indicate lower risk.
| Score | Label | Meaning |
|---|---|---|
| 1 | Low Risk | Strong position; minimal concerns; exceeds expectations |
| 2 | Moderate-Low Risk | Acceptable position; minor gaps easily addressed |
| 3 | Moderate Risk | Some concerns; mitigation recommended; monitor closely |
| 4 | High Risk | Significant concerns; remediation required before or during engagement |
| 5 | Critical Risk | Fundamental gaps; engagement not recommended without major remediation |
Dimension 1: Financial Risk
Assesses the vendor's financial stability, sustainability, and ability to fulfill contractual obligations.
Scoring Criteria
| Score | Indicators |
|---|---|
| 1 | Annual revenue > $100M; profitable for 5+ years; investment-grade credit; audited financials; comprehensive insurance; public company or well-funded private |
| 2 | Annual revenue $25M-$100M; profitable for 2+ years; adequate cash reserves; audited financials available; standard insurance coverage |
| 3 | Annual revenue $5M-$25M; break-even or recently profitable; funded with 18+ months runway; financial statements available but not audited; basic insurance |
| 4 | Annual revenue < $5M; not yet profitable; funded with < 18 months runway; limited financial transparency; minimal insurance |
| 5 | Revenue declining; significant losses; funding uncertain; no financial statements available; no insurance; key dependencies on single revenue source |
Key Indicators to Verify
| Indicator | Source | Red Flag |
|---|---|---|
| Revenue trend | Financial statements, D&B, Crunchbase | Declining revenue for 2+ consecutive quarters |
| Profitability | Income statement, management accounts | Increasing losses without clear path to profitability |
| Cash position | Balance sheet, funding announcements | Less than 12 months runway at current burn rate |
| Customer concentration | Client list, revenue breakdown | Single client > 30% of revenue |
| Insurance | Certificate of insurance | No professional liability or cyber insurance |
| Audit status | Audit reports | No external audit for companies > $10M revenue |
Dimension 2: Operational Risk
Assesses the vendor's operational maturity, resilience, and ability to deliver services consistently.
Scoring Criteria
| Score | Indicators |
|---|---|
| 1 | 200+ employees; documented processes (ISO 9001 or equivalent); tested DR/BCP; geographic redundancy; no key-person dependency; 24/7 support; mature ITSM |
| 2 | 50-200 employees; documented key processes; DR plan in place and tested annually; dedicated support team; limited key-person risk |
| 3 | 20-50 employees; some documented processes; DR plan exists but testing is irregular; support during business hours; moderate key-person dependency |
| 4 | 10-20 employees; ad hoc processes; DR plan not documented or tested; limited support; significant key-person dependency |
| 5 | < 10 employees; no documented processes; no DR/BCP; single point of failure for critical functions; founder-dependent |
Key Indicators to Verify
| Indicator | Source | Red Flag |
|---|---|---|
| Employee count and growth | LinkedIn, company filings | Headcount declining; high turnover |
| DR/BCP maturity | DR plan document, test results | Never tested or tested > 12 months ago |
| Support model | SLA documentation, reference checks | No dedicated support for your contract size |
| Process maturity | ISO 9001, ITIL, internal documentation | No documented processes for service delivery |
| Geographic distribution | Infrastructure documentation | Single data center; single office location |
| Key-person risk | Organizational chart, team bios | Critical knowledge held by 1-2 individuals |
Dimension 3: Compliance Risk
Assesses the vendor's regulatory compliance posture and ability to meet your compliance requirements.
Scoring Criteria
| Score | Indicators |
|---|---|
| 1 | Multiple relevant certifications (ISO 27001, SOC 2 Type II, etc.); dedicated compliance team; quarterly audit cycle; clean compliance history; proactive regulatory monitoring |
| 2 | Key certifications in place; compliance function exists; annual audit cycle; no material compliance findings in last 3 years |
| 3 | Some certifications; compliance responsibility assigned (not dedicated team); annual or irregular audit; minor compliance findings addressed |
| 4 | Limited certifications; no dedicated compliance role; infrequent audits; open compliance findings; reactive approach to regulation |
| 5 | No certifications; no compliance function; no audit history; known compliance violations; no awareness of applicable regulations |
Key Indicators to Verify
| Indicator | Source | Red Flag |
|---|---|---|
| Certifications | Certificate copies, certification body registries | Claims certifications but cannot produce current certificates |
| Compliance team | Organizational structure, LinkedIn | No one with compliance/risk in title or job description |
| Audit history | SOC 2 reports, ISO audit reports | No audit in last 24 months; material findings unresolved |
| Breach history | Public records, regulatory databases, news | Regulatory enforcement action in last 3 years |
| Regulatory awareness | Questionnaire responses | Cannot identify which regulations apply to their services |
Dimension 4: Security Risk
Assesses the vendor's information security posture and ability to protect your data.
Scoring Criteria
| Score | Indicators |
|---|---|
| 1 | SOC 2 Type II + ISO 27001; zero-trust architecture; quarterly pen testing; bug bounty program; SIEM/SOC; encryption everywhere; MFA enforced; mature vulnerability management |
| 2 | SOC 2 Type II or ISO 27001; annual pen testing; encryption at rest and in transit; MFA enforced; incident response plan tested; vulnerability scanning |
| 3 | SOC 2 Type I or working toward certification; annual pen testing; encryption in transit; MFA available but not enforced; incident response plan exists |
| 4 | No security certifications; irregular pen testing; partial encryption; no MFA; incident response plan not documented; limited vulnerability management |
| 5 | No security program; no pen testing; no encryption; no access controls beyond passwords; no incident response capability; known unpatched vulnerabilities |
Key Indicators to Verify
| Indicator | Source | Red Flag |
|---|---|---|
| Security certifications | SOC 2 report, ISO certificate | No certification and no plan to obtain |
| Penetration testing | Pen test executive summary | No pen test in last 12 months; critical findings open |
| Encryption | Technical documentation, architecture diagrams | No encryption at rest; TLS 1.0/1.1 still in use |
| Access controls | Security policy documentation | No MFA; shared admin accounts; no access reviews |
| Incident response | IR plan, tabletop exercise results | No IR plan; never tested; no designated IR team |
| Vulnerability management | Scan reports, patch policy | Mean time to patch critical vulnerabilities > 30 days |
Dimension 5: Reputational Risk
Assesses risks to your organization's reputation from association with this vendor.
Scoring Criteria
| Score | Indicators |
|---|---|
| 1 | Strong brand reputation; industry awards; high employee satisfaction (Glassdoor 4.0+); no public breaches; strong client references; positive media coverage |
| 2 | Positive reputation; good employee reviews; no significant public incidents; client references available; neutral-to-positive media |
| 3 | Average reputation; mixed employee reviews; minor public incidents resolved; limited client references; limited media presence |
| 4 | Below-average reputation; poor employee reviews (Glassdoor < 3.0); public incidents with ongoing impact; client references difficult to obtain; negative media |
| 5 | Poor reputation; active litigation; major data breaches; regulatory sanctions; significant negative media; high employee turnover and negative reviews |
Key Indicators to Verify
| Indicator | Source | Red Flag |
|---|---|---|
| Public breaches | Have I Been Pwned, news archives | Multiple breaches; poor breach response; delayed notification |
| Litigation | Court records, legal databases | Active lawsuits related to service quality or data handling |
| Employee satisfaction | Glassdoor, LinkedIn attrition data | Rating < 3.0; mass layoffs; senior leadership exodus |
| Client references | Direct reference calls | Cannot provide references; references express concerns |
| Media coverage | News search, industry publications | Sustained negative coverage; investigative journalism pieces |
Dimension 6: Strategic Risk
Assesses alignment with your strategic objectives and long-term viability of the relationship.
Scoring Criteria
| Score | Indicators |
|---|---|
| 1 | Market leader; strong roadmap alignment; excellent integration capabilities; low lock-in risk; viable exit strategy; active innovation |
| 2 | Established player; good roadmap alignment; standard API integration; moderate lock-in with clear exit path; regular product updates |
| 3 | Mid-market player; partial roadmap alignment; integration possible with effort; moderate lock-in risk; exit feasible with planning |
| 4 | Niche player; limited roadmap alignment; custom integration required; high lock-in; exit difficult and expensive; limited innovation |
| 5 | Declining market position; no roadmap alignment; no integration capabilities; extreme lock-in (proprietary formats, no data export); no viable exit; stagnant product |
Key Indicators to Verify
| Indicator | Source | Red Flag |
|---|---|---|
| Market position | Analyst reports (Gartner, Forrester), market share data | Declining market share; losing to competitors |
| Product roadmap | Vendor presentations, release notes | No meaningful updates in 12+ months |
| Integration | API documentation, developer portal | No API; custom integration only; proprietary protocols |
| Lock-in risk | Contract terms, data export capabilities | No data export; proprietary data formats; long notice periods |
| Exit feasibility | Migration assessment, alternative vendor analysis | No migration tools; data extraction requires vendor assistance |
Weighting Methodology
Standard Weighting
All dimensions start with equal weight (1.0), with slight reduction for reputational and strategic (0.8) as they are less directly operational.
| Dimension | Standard Weight |
|---|---|
| Financial | 1.0 |
| Operational | 1.0 |
| Compliance | 1.0 |
| Security | 1.0 |
| Reputational | 0.8 |
| Strategic | 0.8 |
Critical Service Weighting
For services classified as critical or essential (e.g., core infrastructure, payment processing, data hosting), apply a 2x multiplier to Security and Compliance dimensions.
| Dimension | Critical Weight |
|---|---|
| Financial | 1.0 |
| Operational | 1.0 |
| Compliance | 2.0 |
| Security | 2.0 |
| Reputational | 0.8 |
| Strategic | 0.8 |
Composite Score Calculation
Composite = Sum(dimension_score * weight) / Sum(weights)Example (Standard):
- Financial: 2, Operational: 3, Compliance: 2, Security: 3, Reputational: 1, Strategic: 2
- Weighted sum: (21.0) + (31.0) + (21.0) + (31.0) + (10.8) + (20.8) = 12.4
- Total weight: 1.0 + 1.0 + 1.0 + 1.0 + 0.8 + 0.8 = 5.6
- Composite: 12.4 / 5.6 = 2.21
Composite Score Interpretation
| Range | Risk Level | Recommendation | Action |
|---|---|---|---|
| 1.0 - 1.5 | Low Risk | Approve | Proceed with standard monitoring |
| 1.6 - 2.5 | Moderate Risk | Approve with Conditions | Proceed with documented mitigations and enhanced monitoring |
| 2.6 - 3.5 | High Risk | Enhanced Due Diligence | Require remediation plan with timelines; consider alternatives; escalate to risk committee |
| 3.6 - 5.0 | Critical Risk | Reject or Require Remediation | Do not proceed without fundamental changes; require executive risk acceptance if proceeding |
Conditional Approval Requirements
When approving with conditions, document:
| Element | Requirement |
|---|---|
| Specific conditions | List each condition with measurable acceptance criteria |
| Timeline | Deadline for each condition to be met |
| Monitoring plan | How compliance with conditions will be verified |
| Escalation path | What happens if conditions are not met by deadline |
| Risk owner | Named individual accountable for monitoring |
Gap Analysis
Severity Classification
| Severity | Definition | Action Required | Timeline |
|---|---|---|---|
| Blocker | Fundamental gap that prevents engagement; unacceptable risk | Must be resolved before contract execution | Before signing |
| Major Concern | Significant gap that materially increases risk | Remediation plan required; contractual commitment to resolve | Within 90 days of contract start |
| Minor Gap | Notable gap with available mitigations | Document mitigation; include in monitoring plan | Within 6 months |
| Acceptable with Mitigation | Small gap that can be managed through contractual or operational controls | Apply mitigation; note in risk register | Ongoing |
Gap-to-Mitigation Mapping
| Gap Type | Example | Mitigation Options |
|---|---|---|
| No SOC 2 certification | Vendor cannot demonstrate security controls independently | Require certification within 12 months; enhanced audit rights; increased insurance |
| No DR testing | Disaster recovery plan exists but never tested | Contractual requirement to test within 6 months; participate in test; backup vendor |
| Key-person dependency | Critical knowledge held by single individual | Knowledge transfer plan; documentation requirements; key-person insurance |
| Limited financial transparency | Privately held; no audited financials | Parent company guarantee; performance bond; escrow; quarterly financial updates |
| No incident response plan | No documented IR capability | Require IR plan within 90 days; tabletop exercise within 6 months; enhanced breach notification |
| High lock-in risk | Proprietary data formats; no export capability | Contractual data portability; regular export testing; maximum term with exit assistance |
#!/usr/bin/env python3
"""
Vendor Comparison Tool
Takes multiple vendor risk assessment JSONs and generates a side-by-side
comparison matrix. Ranks vendors by composite score, highlights strengths
and weaknesses per dimension, and recommends preferred vendor with rationale.
Usage:
python vendor_comparison.py vendor_a.json vendor_b.json
python vendor_comparison.py vendor_a.json vendor_b.json vendor_c.json --json
python vendor_comparison.py vendor_a.json vendor_b.json --critical
"""
import argparse
import json
import sys
from typing import Any, Dict, List, Tuple
# Dimension weights
STANDARD_WEIGHTS: Dict[str, float] = {
"financial": 1.0, "operational": 1.0, "compliance": 1.0,
"security": 1.0, "reputational": 0.8, "strategic": 0.8,
}
CRITICAL_WEIGHTS: Dict[str, float] = {
"financial": 1.0, "operational": 1.0, "compliance": 2.0,
"security": 2.0, "reputational": 0.8, "strategic": 0.8,
}
DIMENSIONS = ["financial", "operational", "compliance", "security", "reputational", "strategic"]
RISK_LEVELS: List[Tuple[float, str, str]] = [
(1.5, "Low Risk", "Approve"),
(2.5, "Moderate Risk", "Approve with Conditions"),
(3.5, "High Risk", "Enhanced Due Diligence"),
(5.0, "Critical Risk", "Reject or Remediate"),
]
def load_vendor_data(file_path: str) -> Dict[str, Any]:
"""Load and validate a vendor assessment JSON file."""
try:
with open(file_path, "r", encoding="utf-8") as f:
data = json.load(f)
except FileNotFoundError:
print(f"Error: File not found: {file_path}", file=sys.stderr)
sys.exit(1)
except json.JSONDecodeError as e:
print(f"Error: Invalid JSON in {file_path}: {e}", file=sys.stderr)
sys.exit(1)
# Validate required structure
vendor_name = data.get("vendor_name", file_path.split("/")[-1].replace(".json", ""))
scores: Dict[str, int] = {}
for dim in DIMENSIONS:
dim_data = data.get(dim, {})
if isinstance(dim_data, dict) and "score" in dim_data:
# Pre-scored format (output from vendor_risk_scorer.py)
scores[dim] = dim_data["score"]
elif isinstance(dim_data, dict):
# Raw questionnaire format -- apply basic scoring
scores[dim] = _quick_score(dim, dim_data)
else:
scores[dim] = 3 # default moderate if missing
return {"vendor_name": vendor_name, "scores": scores, "raw_data": data}
def _quick_score(dimension: str, data: Dict[str, Any]) -> int:
"""Quick-score a dimension from raw questionnaire data (simplified)."""
score = 3 # baseline
positive_keys = [
"audited_financials", "disaster_recovery_plan", "business_continuity_tested",
"geographic_redundancy", "dedicated_support", "compliance_team_exists",
"encryption_at_rest", "encryption_in_transit", "mfa_enforced",
"incident_response_plan", "soc2_type2", "vulnerability_management",
"client_references_available", "industry_recognition",
"exit_strategy_feasible", "innovation_track_record",
]
negative_keys = [
"key_person_dependency", "breach_history", "litigation_history",
"negative_press",
]
for key in positive_keys:
if data.get(key, False) is True:
score -= 0.3
for key in negative_keys:
if data.get(key, False) is True:
score += 0.5
certs = data.get("certifications", [])
score -= min(1.5, len(certs) * 0.5)
return max(1, min(5, round(score)))
def calculate_composite(scores: Dict[str, int], weights: Dict[str, float]) -> float:
"""Calculate weighted composite score."""
weighted_sum = sum(scores[d] * weights[d] for d in DIMENSIONS)
total_weight = sum(weights[d] for d in DIMENSIONS)
return round(weighted_sum / total_weight, 2)
def get_risk_level(composite: float) -> Tuple[str, str]:
"""Get risk level and recommendation from composite score."""
for threshold, level, rec in RISK_LEVELS:
if composite <= threshold:
return level, rec
return "Critical Risk", "Reject or Remediate"
def analyze_strengths_weaknesses(
vendors: List[Dict[str, Any]]
) -> Dict[str, Dict[str, List[str]]]:
"""Identify per-vendor strengths and weaknesses relative to the group."""
analysis: Dict[str, Dict[str, List[str]]] = {}
for vendor in vendors:
name = vendor["vendor_name"]
strengths: List[str] = []
weaknesses: List[str] = []
for dim in DIMENSIONS:
vendor_score = vendor["scores"][dim]
other_scores = [v["scores"][dim] for v in vendors if v["vendor_name"] != name]
if not other_scores:
continue
avg_other = sum(other_scores) / len(other_scores)
if vendor_score < avg_other - 0.5:
strengths.append(f"{dim.title()} ({vendor_score}/5 vs avg {avg_other:.1f})")
elif vendor_score > avg_other + 0.5:
weaknesses.append(f"{dim.title()} ({vendor_score}/5 vs avg {avg_other:.1f})")
analysis[name] = {"strengths": strengths, "weaknesses": weaknesses}
return analysis
def generate_recommendation(
vendors: List[Dict[str, Any]], weights: Dict[str, float]
) -> Dict[str, Any]:
"""Generate preferred vendor recommendation with rationale."""
ranked = sorted(
vendors,
key=lambda v: calculate_composite(v["scores"], weights),
)
preferred = ranked[0]
preferred_composite = calculate_composite(preferred["scores"], weights)
risk_level, rec = get_risk_level(preferred_composite)
rationale_parts: List[str] = []
rationale_parts.append(
f"Lowest composite risk score ({preferred_composite:.2f})"
)
# Find dimensions where preferred vendor leads
for dim in DIMENSIONS:
is_best = all(
preferred["scores"][dim] <= v["scores"][dim]
for v in vendors if v["vendor_name"] != preferred["vendor_name"]
)
if is_best and preferred["scores"][dim] <= 2:
rationale_parts.append(f"Best-in-class {dim} risk ({preferred['scores'][dim]}/5)")
# Note any concerns
concerns: List[str] = []
for dim in DIMENSIONS:
if preferred["scores"][dim] >= 4:
concerns.append(f"{dim.title()} dimension scores {preferred['scores'][dim]}/5 -- requires mitigation")
return {
"preferred_vendor": preferred["vendor_name"],
"composite_score": preferred_composite,
"risk_level": risk_level,
"recommendation": rec,
"rationale": rationale_parts,
"concerns": concerns,
}
def build_comparison_matrix(
vendors: List[Dict[str, Any]], weights: Dict[str, float]
) -> Dict[str, Any]:
"""Build the full comparison result."""
# Calculate composites
vendor_results: List[Dict[str, Any]] = []
for v in vendors:
composite = calculate_composite(v["scores"], weights)
risk_level, rec = get_risk_level(composite)
vendor_results.append({
"vendor_name": v["vendor_name"],
"scores": v["scores"],
"composite_score": composite,
"risk_level": risk_level,
"recommendation": rec,
})
# Sort by composite (lower is better)
vendor_results.sort(key=lambda x: x["composite_score"])
# Rank
for i, vr in enumerate(vendor_results, 1):
vr["rank"] = i
# Analysis
sw_analysis = analyze_strengths_weaknesses(vendors)
recommendation = generate_recommendation(vendors, weights)
# Risk deltas
if len(vendor_results) >= 2:
best = vendor_results[0]["composite_score"]
worst = vendor_results[-1]["composite_score"]
delta = round(worst - best, 2)
else:
delta = 0.0
return {
"vendor_count": len(vendors),
"ranking": vendor_results,
"strengths_weaknesses": sw_analysis,
"recommendation": recommendation,
"risk_delta": delta,
}
def format_text_output(result: Dict[str, Any], critical: bool) -> str:
"""Format comparison results as human-readable text."""
lines: List[str] = []
lines.append("=" * 78)
lines.append("VENDOR COMPARISON MATRIX")
lines.append(f"Vendors Compared: {result['vendor_count']}")
lines.append(f"Weighting: {'Critical Service (2x Security & Compliance)' if critical else 'Standard'}")
lines.append("=" * 78)
lines.append("")
# Ranking table
lines.append("-" * 78)
lines.append(f"{'Rank':<6} {'Vendor':<25} {'Composite':>10} {'Risk Level':<18} {'Recommendation'}")
lines.append("-" * 78)
for vr in result["ranking"]:
lines.append(
f" {vr['rank']:<4} {vr['vendor_name']:<25} {vr['composite_score']:>8.2f} "
f"{vr['risk_level']:<18} {vr['recommendation']}"
)
lines.append("")
# Dimension comparison
lines.append("-" * 78)
lines.append("DIMENSION COMPARISON (1=Low Risk, 5=Critical Risk)")
lines.append("-" * 78)
header = f"{'Dimension':<16}"
for vr in result["ranking"]:
header += f" {vr['vendor_name'][:15]:>15}"
lines.append(header)
lines.append("-" * 78)
for dim in DIMENSIONS:
row = f" {dim.title():<14}"
scores_for_dim = []
for vr in result["ranking"]:
score = vr["scores"][dim]
scores_for_dim.append(score)
bar = "█" * score + "░" * (5 - score)
row += f" {bar} {score:<3}"
# Mark best
best_score = min(scores_for_dim)
lines.append(row)
lines.append("")
# Strengths and weaknesses
lines.append("-" * 78)
lines.append("STRENGTHS & WEAKNESSES")
lines.append("-" * 78)
for vendor_name, sw in result["strengths_weaknesses"].items():
lines.append(f"\n {vendor_name}:")
if sw["strengths"]:
lines.append(" Strengths:")
for s in sw["strengths"]:
lines.append(f" + {s}")
if sw["weaknesses"]:
lines.append(" Weaknesses:")
for w in sw["weaknesses"]:
lines.append(f" - {w}")
if not sw["strengths"] and not sw["weaknesses"]:
lines.append(" No significant differentiators vs. other vendors")
lines.append("")
# Recommendation
rec = result["recommendation"]
lines.append("-" * 78)
lines.append("RECOMMENDATION")
lines.append("-" * 78)
lines.append(f" Preferred Vendor: {rec['preferred_vendor']}")
lines.append(f" Composite Score: {rec['composite_score']:.2f}")
lines.append(f" Risk Level: {rec['risk_level']}")
lines.append(f" Action: {rec['recommendation']}")
lines.append("")
lines.append(" Rationale:")
for r in rec["rationale"]:
lines.append(f" - {r}")
if rec["concerns"]:
lines.append(" Concerns:")
for c in rec["concerns"]:
lines.append(f" ! {c}")
lines.append("")
lines.append(f" Risk Delta (best to worst): {result['risk_delta']:.2f}")
lines.append("")
return "\n".join(lines)
def main() -> None:
"""Main entry point."""
parser = argparse.ArgumentParser(
description="Compare multiple vendors side-by-side and recommend preferred vendor."
)
parser.add_argument(
"input_files", nargs="+",
help="Paths to vendor assessment JSON files (minimum 2)"
)
parser.add_argument("--json", action="store_true", help="Output results as JSON")
parser.add_argument("--critical", action="store_true",
help="Apply 2x weight to security and compliance")
args = parser.parse_args()
if len(args.input_files) < 2:
print("Error: At least 2 vendor files required for comparison.", file=sys.stderr)
sys.exit(1)
vendors: List[Dict[str, Any]] = []
for fp in args.input_files:
vendors.append(load_vendor_data(fp))
# Check for duplicate vendor names
names = [v["vendor_name"] for v in vendors]
if len(names) != len(set(names)):
print("Warning: Duplicate vendor names detected. Results may be ambiguous.", file=sys.stderr)
weights = CRITICAL_WEIGHTS if args.critical else STANDARD_WEIGHTS
result = build_comparison_matrix(vendors, weights)
if args.json:
print(json.dumps(result, indent=2))
else:
print(format_text_output(result, args.critical))
if __name__ == "__main__":
main()
#!/usr/bin/env python3
"""
Vendor Risk Scorer
Scores a vendor across 6 risk dimensions based on questionnaire responses.
Calculates weighted composite score with optional 2x multiplier for critical
services on security and compliance dimensions.
Usage:
python vendor_risk_scorer.py vendor_responses.json
python vendor_risk_scorer.py vendor_responses.json --json
python vendor_risk_scorer.py vendor_responses.json --critical
Input: JSON with vendor_name, service_description, and dimension objects
(financial, operational, compliance, security, reputational, strategic).
See SKILL.md for full input schema.
"""
import argparse
import json
import sys
from typing import Any, Dict, List, Tuple
# Dimension weights (standard)
STANDARD_WEIGHTS: Dict[str, float] = {
"financial": 1.0, "operational": 1.0, "compliance": 1.0,
"security": 1.0, "reputational": 0.8, "strategic": 0.8,
}
# Critical service weights (2x on security and compliance)
CRITICAL_WEIGHTS: Dict[str, float] = {
"financial": 1.0, "operational": 1.0, "compliance": 2.0,
"security": 2.0, "reputational": 0.8, "strategic": 0.8,
}
# Composite score interpretation
RISK_LEVELS: List[Tuple[float, str, str]] = [
(1.5, "Low Risk", "Approve"),
(2.5, "Moderate Risk", "Approve with Conditions"),
(3.5, "High Risk", "Enhanced Due Diligence Required"),
(5.0, "Critical Risk", "Reject or Require Remediation"),
]
def _clamp(score: int) -> int:
"""Clamp score to 1-5 range."""
return max(1, min(5, score))
def score_financial(data: Dict[str, Any]) -> Tuple[int, List[str]]:
"""Score financial dimension (1=Low Risk, 5=Critical Risk)."""
score, findings = 3, []
revenue = data.get("annual_revenue", 0)
if revenue > 100_000_000:
score -= 1; findings.append("Large revenue base reduces financial risk")
elif revenue < 5_000_000:
score += 1; findings.append("Small revenue base increases financial risk")
years = data.get("years_in_business", 0)
if years >= 10:
score -= 1; findings.append(f"{years} years in business -- established track record")
elif years < 3:
score += 1; findings.append(f"{years} years in business -- limited operating history")
prof = data.get("profitability")
if prof == "profitable":
score -= 1; findings.append("Company is profitable")
elif prof == "loss_making":
score += 1; findings.append("Company is loss-making -- monitor cash runway")
if data.get("audited_financials", False):
findings.append("Audited financials available")
else:
score += 1; findings.append("No audited financials -- reduced transparency")
findings.append("Insurance coverage in place" if data.get("insurance_coverage") else "No insurance coverage reported")
return _clamp(score), findings
def score_operational(data: Dict[str, Any]) -> Tuple[int, List[str]]:
"""Score operational dimension."""
score, findings = 3, []
employees = data.get("employee_count", 0)
if employees > 500:
score -= 1; findings.append(f"{employees} employees -- robust operational capacity")
elif employees < 20:
score += 1; findings.append(f"{employees} employees -- limited operational capacity")
for key, pos_msg, neg_msg, neg_score in [
("disaster_recovery_plan", "Disaster recovery plan in place", "No disaster recovery plan -- critical gap", 1),
("business_continuity_tested", "Business continuity plan tested", "Business continuity not tested", 1),
]:
if data.get(key, False):
score -= 1; findings.append(pos_msg)
else:
score += neg_score; findings.append(neg_msg)
if data.get("geographic_redundancy", False):
score -= 1; findings.append("Geographic redundancy in place")
if data.get("key_person_dependency", False):
score += 1; findings.append("Key person dependency identified -- concentration risk")
if data.get("dedicated_support", False):
findings.append("Dedicated support available")
return _clamp(score), findings
def score_compliance(data: Dict[str, Any]) -> Tuple[int, List[str]]:
"""Score compliance dimension."""
score, findings = 3, []
certs = data.get("certifications", [])
if len(certs) >= 3:
score -= 2; findings.append(f"Strong certification portfolio: {', '.join(certs)}")
elif len(certs) >= 1:
score -= 1; findings.append(f"Certifications held: {', '.join(certs)}")
else:
score += 1; findings.append("No recognized certifications -- significant compliance gap")
if data.get("compliance_team_exists", False):
score -= 1; findings.append("Dedicated compliance team exists")
else:
findings.append("No dedicated compliance team")
audit_freq = data.get("audit_frequency", "none")
if audit_freq in ("quarterly", "semi_annual"):
score -= 1; findings.append(f"Audit frequency: {audit_freq}")
elif audit_freq == "annual":
findings.append("Annual audit cycle")
else:
score += 1; findings.append("No regular audit cycle")
if data.get("breach_history", False):
score += 2; findings.append("Prior compliance breach on record -- elevated risk")
return _clamp(score), findings
def score_security(data: Dict[str, Any]) -> Tuple[int, List[str]]:
"""Score security dimension."""
score, findings = 3, []
enc_rest, enc_transit = data.get("encryption_at_rest", False), data.get("encryption_in_transit", False)
if enc_rest and enc_transit:
score -= 1; findings.append("Full encryption (at rest and in transit)")
elif not enc_rest and not enc_transit:
score += 2; findings.append("No encryption reported -- critical security gap")
else:
findings.append("Partial encryption coverage")
if data.get("mfa_enforced", False):
score -= 1; findings.append("MFA enforced")
else:
score += 1; findings.append("MFA not enforced -- access control gap")
pen_test = data.get("pen_test_frequency", "none")
if pen_test in ("quarterly", "semi_annual"):
score -= 1; findings.append(f"Penetration testing: {pen_test}")
elif pen_test == "annual":
findings.append("Annual penetration testing")
else:
score += 1; findings.append("No regular penetration testing")
if data.get("incident_response_plan", False):
findings.append("Incident response plan in place")
else:
score += 1; findings.append("No incident response plan")
if data.get("soc2_type2", False):
score -= 1; findings.append("SOC 2 Type II certified")
if data.get("zero_trust_architecture", False):
score -= 1; findings.append("Zero trust architecture implemented")
return _clamp(score), findings
def score_reputational(data: Dict[str, Any]) -> Tuple[int, List[str]]:
"""Score reputational dimension."""
score, findings = 2, [] # baseline low-moderate
breaches = data.get("public_breaches", 0)
if breaches > 2:
score += 2; findings.append(f"{breaches} public breaches -- significant reputational concern")
elif breaches > 0:
score += 1; findings.append(f"{breaches} public breach(es) on record")
else:
findings.append("No public breaches on record")
if data.get("litigation_history", False):
score += 1; findings.append("Litigation history present")
if data.get("negative_press", False):
score += 1; findings.append("Negative press coverage identified")
rating = data.get("glassdoor_rating", 0)
if rating >= 4.0:
score -= 1; findings.append(f"Glassdoor rating: {rating}/5 -- strong employee satisfaction")
elif 0 < rating < 3.0:
score += 1; findings.append(f"Glassdoor rating: {rating}/5 -- employee satisfaction concern")
if data.get("client_references_available", False):
findings.append("Client references available")
else:
score += 1; findings.append("No client references available")
return _clamp(score), findings
def score_strategic(data: Dict[str, Any]) -> Tuple[int, List[str]]:
"""Score strategic dimension."""
score, findings = 3, []
position = data.get("market_position", "unknown")
score += {"leader": -2, "established": -1, "growing": 0, "niche": 0, "declining": 2}.get(position, 0)
findings.append(f"Market position: {position}")
alignment = data.get("product_roadmap_alignment", "low")
score += {"high": -1, "moderate": 0, "low": 1}.get(alignment, 0)
findings.append(f"Product roadmap alignment: {alignment}")
lock_in = data.get("lock_in_risk", "low")
score += {"low": -1, "moderate": 0, "high": 1, "critical": 2}.get(lock_in, 0)
findings.append(f"Lock-in risk: {lock_in}" + (" -- exit strategy critical" if lock_in in ("high", "critical") else ""))
if data.get("exit_strategy_feasible", False):
findings.append("Exit strategy assessed as feasible")
else:
score += 1; findings.append("Exit strategy not feasible -- significant strategic risk")
return _clamp(score), findings
def calculate_composite(
dimensions: Dict[str, Dict[str, Any]], critical: bool
) -> Tuple[float, str, str]:
"""Calculate weighted composite score and determine risk level and recommendation."""
weights = CRITICAL_WEIGHTS if critical else STANDARD_WEIGHTS
weighted_sum = sum(dimensions[d]["score"] * weights[d] for d in dimensions)
total_weight = sum(weights[d] for d in dimensions)
composite = weighted_sum / total_weight
risk_level = "Critical Risk"
recommendation = "Reject or Require Remediation"
for threshold, level, rec in RISK_LEVELS:
if composite <= threshold:
risk_level = level
recommendation = rec
break
return round(composite, 2), risk_level, recommendation
def generate_heat_map(dimensions: Dict[str, Dict[str, Any]]) -> List[str]:
"""Generate a text-based risk heat map."""
labels = {1: "LOW", 2: "MOD-LOW", 3: "MODERATE", 4: "HIGH", 5: "CRITICAL"}
lines: List[str] = []
for dim, data in dimensions.items():
score = data["score"]
bar = "█" * score + "░" * (5 - score)
label = labels.get(score, "???")
lines.append(f" {dim.title():<14} [{bar}] {score}/5 {label}")
return lines
def format_text_output(result: Dict[str, Any]) -> str:
"""Format results as human-readable text."""
lines: List[str] = []
lines.append("=" * 70)
lines.append(f"VENDOR RISK ASSESSMENT: {result['vendor_name']}")
lines.append("=" * 70)
lines.append("")
lines.append(f"Service: {result.get('service_description', 'N/A')}")
lines.append(f"Critical Service: {'Yes (2x weight on Security & Compliance)' if result['critical'] else 'No (standard weighting)'}")
lines.append(f"Composite Score: {result['composite_score']:.2f} / 5.00")
lines.append(f"Risk Level: {result['risk_level']}")
lines.append(f"Recommendation: {result['recommendation']}")
lines.append("")
lines.append("-" * 70)
lines.append("RISK HEAT MAP")
lines.append("-" * 70)
lines.extend(generate_heat_map(result["dimensions"]))
lines.append("")
lines.append("-" * 70)
lines.append("DIMENSION FINDINGS")
lines.append("-" * 70)
for dim, data in result["dimensions"].items():
lines.append(f"\n {dim.title()} (Score: {data['score']}/5):")
for finding in data["findings"]:
lines.append(f" - {finding}")
lines.append("")
gaps = result.get("gaps", [])
if gaps:
lines.append("-" * 70)
lines.append("GAP ANALYSIS")
lines.append("-" * 70)
for gap in gaps:
lines.append(f" [{gap['severity'].upper()}] {gap['dimension'].title()}: {gap['description']}")
lines.append("")
return "\n".join(lines)
def identify_gaps(dimensions: Dict[str, Dict[str, Any]]) -> List[Dict[str, str]]:
"""Identify gaps based on dimension scores."""
gaps: List[Dict[str, str]] = []
severity_map = {5: "blocker", 4: "major_concern", 3: "minor_gap"}
for dim, data in dimensions.items():
score = data["score"]
if score >= 3:
severity = severity_map.get(score, "minor_gap")
for finding in data["findings"]:
if any(w in finding.lower() for w in ["gap", "no ", "not ", "concern", "critical", "elevated"]):
gaps.append({"dimension": dim, "severity": severity, "description": finding})
return gaps
def main() -> None:
"""Main entry point."""
parser = argparse.ArgumentParser(
description="Score a vendor across 6 risk dimensions and generate recommendation."
)
parser.add_argument("input_file", help="Path to JSON file with vendor questionnaire responses")
parser.add_argument("--json", action="store_true", help="Output results as JSON")
parser.add_argument("--critical", action="store_true",
help="Apply 2x weight to security and compliance (critical services)")
args = parser.parse_args()
try:
with open(args.input_file, "r", encoding="utf-8") as f:
data = json.load(f)
except FileNotFoundError:
print(f"Error: File not found: {args.input_file}", file=sys.stderr)
sys.exit(1)
except json.JSONDecodeError as e:
print(f"Error: Invalid JSON: {e}", file=sys.stderr)
sys.exit(1)
# Score each dimension
scorers = {
"financial": score_financial,
"operational": score_operational,
"compliance": score_compliance,
"security": score_security,
"reputational": score_reputational,
"strategic": score_strategic,
}
dimensions: Dict[str, Dict[str, Any]] = {}
for dim, scorer in scorers.items():
dim_data = data.get(dim, {})
score, findings = scorer(dim_data)
dimensions[dim] = {"score": score, "findings": findings}
composite, risk_level, recommendation = calculate_composite(dimensions, args.critical)
gaps = identify_gaps(dimensions)
result = {
"vendor_name": data.get("vendor_name", "Unknown Vendor"),
"service_description": data.get("service_description", "N/A"),
"critical": args.critical,
"composite_score": composite,
"risk_level": risk_level,
"recommendation": recommendation,
"dimensions": dimensions,
"gaps": gaps,
}
if args.json:
print(json.dumps(result, indent=2))
else:
print(format_text_output(result))
if __name__ == "__main__":
main()
Related skills
FAQ
How many risk dimensions does it score?
Six risk dimensions, with a 2x multiplier applied to security and compliance for critical services.
Which regulatory frameworks does it cover?
Eight: GDPR, DORA, NIS2, SOX, PCI DSS, ISO 27001/SOC 2, HIPAA, and FedRAMP.