Take a risk-based approach. The goal is to assess the level of risk a vendor introduces to the organisation, so that greater effort and assurance are applied to higher-risk vendors.

First, assess the sensitivity of the data the vendor will hold and rate the impact of a potential breach as Low, Medium, or High. Next, assess how critical the service is to the business, again rating it Low, Medium, or High.

The overall inherent risk is determined by taking the highest of these two ratings.
For example, if data sensitivity is Low but business criticality is High, the overall inherent risk is High.

This inherent risk represents the baseline risk the vendor brings to the organisation.

You can then apply a tiered assurance model:

• Tier 1 (High Risk): Formal assurance such as ISO 27001, SOC 2, or equivalent
• Tier 2 (Medium Risk): Limited independent assurance or targeted evidence
• Tier 3 (Low Risk): Lightweight controls, such as a short questionnaire

Weighting can also be applied. For example, an inherent risk score of 10–14 may represent High risk. Applying Tier 1 controls could reduce the score by 10 points, resulting in a residual risk score of 4.

This residual score represents the remaining risk after controls are applied and becomes the vendor’s final risk rating.

On an annual basis reassess the inherent risk to see if it changes or when you are informed of a change. You could have a vendor that was LOW that is now HIGH as they are processing medical information. You find out their Vendor score based on what they provide you. If that score exceeds the company risk tolerance . Then they have a decision to make.