Third-Party Risk Assessment Workflow
Assess a vendor for security and data-handling risk before onboarding, with conditions and periodic review.
Objective
Evaluate and approve third-party vendors based on security and privacy risk.
Environment
- A vendor questionnaire
- Data classification
- Contract review
Steps
1. Classify the data shared
Determine what data the vendor will access and its sensitivity.
Expected state: The data exposure to the vendor is clear.
2. Assess controls
Review the vendor security controls, certifications, and incident history.
Expected state: Control gaps are documented.
3. Set conditions for approval
Apply contractual or technical conditions to mitigate identified gaps.
Expected state: Approval is conditional on specific mitigations.
4. Schedule periodic review
Set a review cadence based on risk and data sensitivity.
Expected state: Vendor risk is re-evaluated over time.
Decision points
Approve or reject on gaps?
- Approve with conditions
- Reject on any gap
Approve with conditions when gaps are mitigatable; reject unresolvable critical gaps.
How often to review?
- Risk-based cadence
- Annual for all
Set cadence from data sensitivity and vendor criticality.
Expected outcome
Vendors are onboarded with an explicit risk assessment and conditions, and reviewed periodically.
Verification
Confirm the assessment covers data exposure and controls, conditions are recorded, and a review date is set.
Cleanup
Archive the assessment and update it at each review.
Overview
Evaluate and approve third-party vendors based on security and privacy risk.
This workflow is reusable across teams and environments; adapt the commands to your tooling while keeping the sequence and checkpoints intact.
Environment and prerequisites
- A vendor questionnaire
- Data classification
- Contract review
Procedure
1. Classify the data shared
Determine what data the vendor will access and its sensitivity.
Expected state: The data exposure to the vendor is clear.
2. Assess controls
Review the vendor security controls, certifications, and incident history.
Expected state: Control gaps are documented.
3. Set conditions for approval
Apply contractual or technical conditions to mitigate identified gaps.
Expected state: Approval is conditional on specific mitigations.
4. Schedule periodic review
Set a review cadence based on risk and data sensitivity.
Expected state: Vendor risk is re-evaluated over time.
# track vendor data classification
vendorctl assess --name acme --data pii --tier 1Verification
Confirm the assessment covers data exposure and controls, conditions are recorded, and a review date is set.
Decision points
Approve or reject on gaps?
- Approve with conditions
- Reject on any gap
Recommendation: Approve with conditions when gaps are mitigatable; reject unresolvable critical gaps.
How often to review?
- Risk-based cadence
- Annual for all
Recommendation: Set cadence from data sensitivity and vendor criticality.
Common failures
- Onboarding without assessment hides risk.
- Unconditional approval ignores mitigatable gaps.
- No review cadence lets risk drift.