Free Engineering Workbench calculator
Vendor risk tiering
Tier a supplier by inherent risk and control evidence, and re-run it at each review.
Procurement & vendor managementHow it's worked out
- Inherent = (criticality + data access + substitutability) ÷ 15 × 100. Residual = inherent × control evidence factor
- Equal weights; evidence factors are platform-defined
NoteA platform-defined score to make tiering consistent. Set your own weights and review frequency in your third-party risk policy.
Source: Platform-defined; aligned in spirit with ISO/IEC 27001:2022 A.5.19 to A.5.22
Need help acting on this number?
VVnT SeQuor's Core IT & Managed Services practice helps teams turn this metric into a plan.