What is vendor tiering?
Vendor tiering sorts vendors by inherent risk, based on the service they provide and the data and access involved, so the depth of due diligence matches the risk.
Vendor tiering sorts vendors into risk tiers, commonly critical, high, moderate, and low, based on inherent risk factors like the service they provide, how sensitive the data they access is, their access to systems, and how critical they are to operations. The tier sets how deep due diligence and ongoing monitoring should go.
Common tiering factors
- Type and sensitivity of data the vendor handles
- Level of access to systems and networks
- Criticality of the service to operations
- Regulatory implications of the relationship
- Ease of replacing the vendor
What tiers change
| Tier | Typical review |
|---|---|
| Critical | Full questionnaire, evidence review, contract terms, frequent reassessment |
| High | Standard questionnaire and evidence, annual reassessment |
| Moderate | Short questionnaire, periodic review |
| Low | Basic screening |
What to look for
Tiering is the first thing to look for in TPRM. Sending every vendor the same questionnaire wastes their time and yours.
Questions
How often should vendor tiers be reviewed?
Whenever the relationship changes and at least periodically, since vendors often expand what they do for you over time.
See it run on your own data.
Book 30 minutes with a GRC specialist. Bring a real document, like a SOC 2 report, risk register, or vendor list (redacted is fine), and we'll show TruOps AI working on it.