In our 2024 survey of more than 500 cybersecurity and risk leaders, we found that over 50% of companies work with 100 or more unique vendors. That’s an increase of 12% compared to 2023. The average number of vendors per company is nearly 240.

It’s clear that a reliance on third-party relationships is growing. So is the threat posed by those third parties—88% of companies that experienced a recent security breach report that breach originating with a vendor (an YoY increase of 11%).

What’s not growing? Resources, hours in a day, or often even the size of your risk management team. As the threat of a breach grows with your vendor inventory, the tools to mitigate risk remain static.

While there are many tools and solutions available to expand your capacity and increase efficiency, none of these will work without strong, foundational practices for third-party risk management (TPRM). That process starts before you even begin working with a third party—with a vendor risk assessment.

Let’s take a closer look at the critical components of an excellent vendor assessment, including steps, best practices, and opportunities to optimize your assessment program.

What Is a Vendor Risk Assessment?

A vendor risk assessment is a systematic approach to evaluating the potential risks that vendors may pose to your organization. This assessment involves analyzing various factors such as the vendor’s security practices, financial stability, and compliance with relevant regulations. The goal is to ensure that your vendors adhere to the necessary risk management practices, ultimately protecting your organization from potential disruptions or breaches.

A vendor risk assessment is a systematic approach to evaluating the potential risks that a third party may pose to your organization. There are different categories and degrees of risk (more on that in a moment), and different parts of your business may interact with the same vendor differently. This makes assessing risk more complex and engages a wide range of stakeholders. Your approach should consist of both broadly applicable guidelines and vendor-specific criteria.

It’s a tricky balance to strike, but matching the right type and depth of assessment with the right vendor increases efficiency and gives you a more consistent view of risk across your overall third-party landscape. There are some straightforward things your organization can do to categorize risk. Let’s dive into them now.

Essential Factors for Assessing Vendor Risks

Unpacking the complexity of TPRM starts with a clear view of the kinds of risks your organization is facing. As we mentioned, your assessment needs may vary from vendor to vendor and department to department, but the broad categories of risk typically fall into handful of consistent buckets:

Cybersecurity Risks
Vendors often have access to sensitive data, making them prime targets for cyberattacks. A thorough risk assessment will review documentation to validate the vendor’s security posture and ensure they are taking appropriate steps to protect themselves from vulnerabilities (and thus protect you).

The amount and kind of vendor information you need to review will depend on factors like the types and volumes of data the vendor will access (Is it proprietary? Is it personal customer data? Is it business-critical?) and the kinds of systems the solution will interact with.

Regulatory Compliance Risks
Many industries are subject to strict regulatory requirements regarding data protection and privacy. A vendor risk assessment ensures that your vendors comply with these regulations, reducing the risk of fines and penalties.

There may be industry-standard assessment questionnaires or specific audit reports that your vendor will have to complete/provide in order to ensure compliance. You may also choose to develop a customized assessment that captures your unique industry requirements. Be sure you clearly document your needs as part of your codified process.

Operational Risks
How important is the vendor to the functioning of your business? If there was ever a loss of service, what would be the impact? Assessing operational risk helps you to answer these questions and create contingency plans in the event of an incident.

By assessing cybersecurity risks, you will uncover some of these operational vulnerabilities, too. But you may also wish to conduct an on-site inspection of the vendor’s facilities, place explicit business continuity agreements in your contract language, and establish clear service-level agreements (SLAs) that assign responsibility and detailed remediation in the event that service is lost.

Reputational Risks
The actions of your vendors can reflect on your organization. A vendor risk assessment helps identify any potential reputational risks, allowing you to take proactive measures to protect your brand.

As an example, if vendor negligence leads to a security breach that exposes the personal identifiable information (PII) of your customers, it could not only materially affect them but also impact the trustworthiness of your business for other potential customers. This reputational harm increases the risk. You may wish to conduct interviews with senior leadership from your vendors, speak with their existing or past clients, or do a thorough audit of their value statements in order to better understand reputational risk.

When a Vendor Risk Assessment is Necessary

The myriad risks that come with engaging a third party can occur at several points across the vendor lifecycle. Here are some of the most common points in that cycle for conducting an assessment (or reassessment, in the case of existing vendors):

During the selection process
Another way we might say this is, “As soon as possible!”

Waiting to consider risk factors can slow down the procurement and onboarding process. And when you’re excited to start using a new solution or tool—especially when there is an important need the vendor satisfies—there’s nothing worse than lengthy delays when you uncover an obvious risk factor you might have discovered months earlier. In this situation, companies often end up accepting more risk than is necessary.

Whenever it becomes clear that a business unit needs a vendor solution or software, your vendor risk assessment team should be part of the process (we’ll discuss other stakeholders to engage in a minute). Risk should be factored into the selection process as you evaluate various vendors—and you should have some sense of their risk profile before you even talk to a sales rep.

You may not be able to conduct a thorough assessment until you’ve started speaking with vendors, but most third parties have a public trust center that contains their basic security posture. Other places to collect basic security information include marketplaces and review sites like G2; Whistic also provides users with access to our Trust Catalog, which contains security documentation for thousands of vendors so you can filter out risk factors as early as possible.

It probably won’t be the ultimate deciding factor in your vendor selection, but it’s also worth considering how forthcoming a vendor is about their security posture. Third parties that readily provide security information build trust faster, establish a track record of transparency, and make onboarding easier.

During the Purchasing and Onboarding Process
Once you’ve screened for the most obvious risk factors during selection, you’ll commonly engage in a more thorough vendor risk assessment as part of the final purchasing process. This is the stage at which you’ll confirm vendor compliance with your regulatory needs, review detailed security audits and documentation, and collect answers to your specific or unique security requirements.

Once you’ve purchased a solution, vendor onboarding is another common touchpoint for assessing risk. There should be no surprises at this point, but you should have a mechanism in place for final validation before you give the vendor full access to your systems and data.

During Regular Reassessments
You should have a plan in place to reassess vendors at a regular cadence depending on the risk level of the vendor (something you’ll determine during your initial assessment).

The timing of these reassessments may vary by vendor type. A higher-risk vendor may require more frequent check-ins than a low-risk vendor. These reassessments are also a good time to review any contract language around deliverables, service-level agreements (SLAs), or other performance metrics to understand if the vendor remains a good fit for your business.

Following a Security Incident
Your business should have an incident response plan in place in the event that you experience a security breach so you can understand the impact of the incident and take steps to remediate any damage.

Part of this plan should include an audit of your vendors to understand if the incident originated in your third-party ecosystem. If the breach comes through a vendor (as 88% of them do in 2024), your risk assessment will help you determine scope and determine responsibility in the event of legal action as a result of the breach.

Sometimes, there will be a security incident that exposes a common vulnerability or exposure (CVE) that has broad-sweeping impacts across multiple industries or sectors. This was the case with the recent Crowdstrike incident or Snowflake targeted cyber campaign. In these instances, Whistic provides users with custom-built questionnaires to help you understand whether your vendors have been affected. These come standard in the Whistic library.

If Your Business Requirements and Needs Change
Businesses are constantly evolving, and your risk tolerance may change along with your organization. Perhaps a new regulation passes and your industry is now accountable to a new standard; maybe you’ve launched a new product line that incorporates more customer data; maybe you’re interested in using AI solutions and need a baseline for that kind of risk. These are just a few examples, but there are numerous changes that might necessitate a vendor risk assessment.

Key Steps in Conducting a Vendor Risk Assessment

Alright, so, how does a vendor risk assessment actually work? We’re delighted you asked.

Conducting a vendor risk assessment involves several key steps. This process helps you understand your overall vendor landscape, calibrate your risk tolerance as a business, creates standard categorization for vendors so you can rank risks consistently, and allows you to move as efficiently as possible through the process.

Sounds like a lot, but luckily, it can be rendered in a list thusly:

1. Identify Vendors
There’s a common business truism (probably) that says something to the effect of, “You can’t measure what you can’t see.” This may have been said in reference to vast distances in outer space, but it applies just as well to vendor risk.

In order to measure and assess risk, you need a full inventory of all the vendors you work with. This can be challenging, but it’s worth the effort to avoid a costly breach. It’s also a useful exercise to help you control costs by cutting vendors you don’t use or extract more business value out of those you do.

Your vendor inventory should be a centralized repository of vendor profiles—that is, a uniform set of details about each vendor that includes information like:

Annual spend/cost associated with the vendor
Contract details
The types and volumes of data the vendor has access to
Systems the vendor can access
How essential they are to your business

This information will give you a consistent rubric for comparing vendors, even if they perform very different functions for your business. You’ll also use this info to rank your vendors by risk so you can understand how and when to assess them.

2. Develop a Risk-Ranking System to Categorize Vendors
If you read the last sentence of the previous step, you’ll get the idea, but let’s drill down just a wee bit into risk ranking.

When you create your vendor inventory, you’ll establish a clear set of risk factors for each vendor that depend on the data and systems they can access. This allows you to develop a basic rubric or score for risk to build out your assessment strategy.

We suggest keeping this process simple. Start by designating your vendors as “high,” “medium,” or “low” risk, and determine which factors correspond to each risk level. It’s important to understand what risk factors make a vendor “high risk” versus “medium risk,” as that will determine the types of (re)assessments they’ll need, help you allocate the right resources to monitoring vendors, and guide your risk mitigation strategy.

3. Gather and Analyze Vendor Information
You may quibble and say this is more like a step 2; we won’t fight you over it, but we simply feel it’s important to have an established risk ranking and categorization methodology in place early on in the development (or evolution) of your TPRM program. You need to understand the criteria you’re using before the information you collect can have meaningful context.

But of course you WILL need to collect information to understand how the vendor stacks up with your risk ranking. The information you’ll need will cover the gamut of risks we discussed earlier:

Documentation to detail security practices
Proof of regulatory compliance
Financial statements/records to assess stability
Record of previous breaches/incidents, along with response plans

There are a number of ways you can go about collecting this information. As we mentioned before, you can find some of this information by proactively viewing publicly available trust centers on vendor websites or marketplaces. But more commonly, customers engage their vendors with security questionnaires—specific questions designed to uncover all the info you need to make a smart, secure decision.

There are numerous types of security questionnaires you might use, including:

Standard, codified frameworks (SOC 2, NIST, ISO, SIG, CAIQ)
Industry-specific frameworks (HECVAT, HIPAA)
Customized (these are aligned to your specific business, but typically include questions from other standard frameworks)

[Shameless Whistic Plug About the Questionnaire Process...

It’s at this point we need to intervene, because we at Whistic like to think we have a little expertise at this part.

Collecting information through questionnaires has always been a highly manual process. You’ll need to understand which assessment type is best for the vendor, email them the right questionnaire, wait for responses, send the questionnaire AGAIN when you don’t get all the answers you need, and often never get it anyway (so you do all that legwork just to take on more risk).

Imagine doing this for hundreds of vendors every year. Will your security team have any time left over to actually manage risk?

Moving to Modern TPRM
We call this “legacy TPRM,” and it relies on precise answers to exact questions…or it really doesn’t work at all. But Whistic is “Modern TPRM,” which automates the assessment process using the types of information that you already have and that’s easiest for the vendor to provide.

Let’s say you’ve developed a great, customized questionnaire that covers all your security bases. It’s just one questionnaire—but it’s 275 questions long. Increasingly, vendors simply will not respond to this kind of request. But what they WILL do is provide you with their SOC 2 report and say, “Here, you find the answers.”

In legacy TPRM, after sighing heavily, you’d roll up your sleeves and start searching the document manually for the answers. Another manual stop that can delay procurement by days, weeks, or even months.

Or, you could automate the response process using the documentation you have.

AI-First, Automated Risk Assessments
AI makes it possible to use the information in raw security data like a SOC 2 and extract context-specific answers to your questions. We call this Assessment Copilot, and it makes it possible to generate automated responses to your questionnaires, gives you confidence scores for the answers, provides direct citations to relevant documents (along with a link—no more searching), and identifies questions that still need attention from your team. Your vendors are far more likely to answer 10 questions than hundreds.

You can learn more about Assessment Copilot and Whistic’s AI-first approach to TPRM here, or here, and definitely here.

Now, back to your regularly scheduled blog post]

4. Develop Risk Mitigation Strategies
Now you have the information you need to understand your vendor’s security posture, and you’ve got a rubric in place to compare vendors consistently and understand your risk exposure. Now it’s time to act on the information you have.

The first step in vendor risk mitigation is your decision to purchase their solution in the first place. With the info you have, you can answer some critical questions about the vendor:

Does the vendor deliver enough business value to offset any risks you’ve uncovered?
Is the level of risk acceptable from a regulatory and reputational perspective?
Is the vendor willing to work with us to mitigate existing risk factors?
Do you have the right resources to manage the risks you’ve uncovered?

While each of these questions is crucially important, it’s the last question that often gets overlooked in the assessment process. You are also assessing your own capacity to manage risk.

It’s one thing to identify risks, but you must have the right team, tools, and processes in place to continuously monitor high-risk vendors, conduct regular reassessments, and respond to unforeseen incidents. Assessing your vendors consistently and thoroughly allows you to properly allocate resources to the right activities based on risks. This can increase the reach of your InfoSec team by helping them focus on the right things.

Best Practices for Vendor Risk Assessments

These practices help ensure that you get the most out of your vendor assessment process.

1. Leverage the right TPRM Solutions
We clearly have a horse in this race, but even if you opt for a different TPRM solution, these tools can be a huge help in centralizing vendor inventories and data; triggering automated workflows to reassess or manage incidents; align stakeholders for better collaboration; and fuel time savings and efficiencies.

The Whistic platform is AI-first for both buyers and vendors. Our full-cycle TPRM platform utilizes AI at every step of the process so you can automate assessments, generate reports for senior leadership, and reduce the burden on your vendors. (And for you vendors out there, Whistic AI also automates the questionnaire response process, so you can build trust and close deals faster).

2. Involve the Right Stakeholders
Vendor risk assessments should not be conducted in isolation. It’s essential to involve key stakeholders from across the organization, including IT, InfoSec, Legal, Procurement, and Compliance teams. This ensures that all relevant risks are considered and that the assessment process aligns with broader business objectives.

3. Document and Report Findings
It’s essential to track the performance of your program over time. As we mentioned earlier, risk factors can change quickly, so the ability to pivot effectively depends on the health of your program. Clear documentation of process, the formation of a governance team to regularly engage stakeholders, and established metrics will make it possible to understand your strengths, address challenges, and adapt quickly.

We are also seeing increased engagement from the C-suite on third-party risk management as vendors grow more essential to business outcomes. This attention is also impacting TPRM budgets. That means developing high-level, strategic reporting that is appropriate (and digestible) for executives is essential.

Whistic Helps you Deliver a Fully Mature Vendor Assessment Process

Vendor risk assessments are a critical component of any organization’s risk management strategy. By systematically identifying, evaluating, and mitigating risks associated with third-party vendors, organizations can protect themselves from a wide range of potential threats.

But at Whistic, we realize your resources are finite. We want you to be able to assess every vendor you need with the depth and richness necessary to keep your business thriving and secure. We don’t want you to take on unnecessary risk simply because you’re spending all your resources managing documents (instead of risks).

That’s why our AI-first, Modern TPRM platform may be a good fit for your organization. Let us show you how our AI approach is automating the assessment process for our customers. You can ask us anything, or simply see it for yourself with a quick, hassle-free demo. Book yours today.