Score vendors on exposure (data sensitivity × criticality) and security posture (six weighted domains), tier them, drive reassessment cadence — with BAA/DPA tracking for HIPAA programs.
A vendor's risk is the exposure they represent and how well they control it. This assessment scores both, combines them on the same 1–25 scale as the risk register, and lets the tier drive how often you reassess — so the riskiest vendors get looked at most often.
Every number is a formula over your inputs — not a workshop opinion. Change an input and the ratings move. That's what makes the output defensible.
One row per vendor: exposure, six weighted posture domains, risk score and tier, BAA/DPA, reassessment-due and overdue flags — all calculated.
Exposure factors, posture-domain weights, and tier bands your team calibrates to.
Auto tier distribution, vendors by data sensitivity, top-risk vendors, and missing-BAA count.
How the program supports SOC 2, ISO 27001, and HIPAA.
Every column heading defined, with a Source column.
A five-step walkthrough and worked examples.
Every rating is a transparent formula over your inputs, so it holds up when someone asks "why is this rated this way?"
Ratings trace back to the inputs that produced them — the audit story is built in, not reconstructed after the fact.
A built-in Compliance Mapping tab cross-walks the program to SOC 2, ISO 27001, HIPAA, and DORA third-party requirements.
Related: Integrating Risk Assessments and The Connected GRC Model.
A single Microsoft Excel workbook (.xlsx). It recalculates on open — no macros, no add-ins, no subscription. Also opens in Google Sheets and LibreOffice.
No. You fill the shaded input cells; the white cells calculate. Dropdowns prevent bad entries, the Start Here tab walks you through it, and it ships with worked examples you delete before use.
Yes — internally or in client engagements. You can't resell the template itself as a template.
If you need it adapted to a specific framework, org size, or regulator, get in touch — customization and advisory are available.
A defensible vendor risk score, the right reassessment cadence, and BAA/DPA tracking built in.