Vendor Risk Scoring for Regulated SMBs
A vendor breach becomes your breach. Most SMBs 'assess vendors' with a gut check at procurement and never again. A lightweight four-factor rubric produces a repeatable risk score, sorts vendors into tiers, and sets a review cadence that matches the risk.
Vendor risk scoring rubric
Copy as markdown to paste into your repo, or download a branded PDF for sharing with non-technical stakeholders.
Frequently asked questions
How do you score vendor risk for a small business?
Rate each vendor 1 to 3 on four factors — data sensitivity, access and integration depth, attestation gap, and blast radius — then sum them into a 4-12 score. The score sorts each vendor into a tier, and the tier sets how often you review them. It's a rubric, not a GRC platform.
What are the four factors in the vendor risk rubric?
Data sensitivity (what class of data the vendor can touch), access and integration depth (how wired in they are), attestation gap (how little they've proven about their security), and blast radius (what it costs you if they're compromised or vanish). Data sensitivity is the biggest lever, so weight it heaviest.
How often should I review my vendors?
Let the tier decide. Critical (10-12) and High (7-9) vendors get a security review at procurement plus an annual re-review; Medium (5-6) vendors are re-reviewed on material change; Low (4) vendors get a lightweight check at procurement and no scheduled re-review.
When should I re-score a vendor?
The annual cadence is the floor. Re-score immediately if a vendor discloses a breach of their own — that's the moment their risk to you changed, and a Critical-tier vendor's incident is your incident. Most SMBs do nothing here because no process points at it.
Does a vendor's SOC 2 report mean they're safe?
No. A current, in-scope attestation isn't proof of safety, but its absence is a real signal — especially from a vendor touching regulated data. The rubric scores the attestation gap as one of four factors, not as a pass/fail verdict.
Do I need a GRC platform to do vendor risk scoring?
No. The whole point is a cheap, repeatable rubric you'll actually run — four factors, a 4-12 score, and a tier that sets the review cadence. Its job is triage: telling you which five vendors out of forty deserve the deep review your team actually has time for.
Get the next one.
New operating guides as we publish them — practical, infrequent, unsubscribe in one click.
You inherited every vendor's security posture. Score it.
Kaan Systems does platform engineering and Terraform for funded SaaS, health-tech, and fintech. Compliance evidence is the by-product of that work. The Teardown applies the rubric to the vendors that can reach customer data. The Architecture and Compliance Teardown is a written read in about five business days. Book a call.