Every vendor connected to your systems is a door into your business you don’t fully control. 61% of 2024 supply-chain attacks originated one hop removed from the primary vendor — not the vendor itself, but something the vendor depended on. Most small and mid-sized businesses have never inventoried which vendors can touch sensitive data, let alone reviewed how well those vendors protect it.
When a Vendor Becomes the Breach
A 40-person accounting firm outsourced its client document portal to a third-party SaaS vendor. The vendor left a known vulnerability unpatched for 97 days. Attackers used it to access tax records for over 1,200 clients. The firm had never reviewed the vendor’s security practices, and its contract had no breach-notification requirement — it learned about the incident from a client, not the vendor. Notification costs, legal fees, and lost clients topped $310,000.
Not All Vendors Deserve the Same Scrutiny
Reviewing every vendor with the same depth wastes time on low-risk relationships and starves the ones that actually matter. Tier vendors first, based on what they touch:
- Tier 1 – Critical: stores, processes, or transmits regulated or sensitive data, or holds privileged access to core systems — review annually plus quarterly check-ins
- Tier 2 – High: access to internal systems or non-regulated business data — review annually
- Tier 3 – Medium: limited system access, or public-facing data only — review every two years
- Tier 4 – Low: no data access and no system integration — review on renewal only
What to Ask Every Tier 1 and Tier 2 Vendor
A Vendor Security Assessment Questionnaire (VSAQ) belongs in every new contract and every annual review. At minimum, ask about:
- Security certifications held (SOC 2 Type II, ISO 27001, etc.) and whether there is a dedicated security lead
- Any security incident or breach in the last three years, and how it was handled
- Whether MFA is enforced and how privileged access is managed
- Encryption standards for data at rest and in transit
- Vulnerability scanning cadence and patching SLAs
- Incident notification timelines owed to you as a customer
Score every response on a consistent 0–100 scale so results are comparable period over period — a vendor whose score drops for two consecutive reviews should be escalated regardless of its absolute score.
Get the Free Vendor Security Scorecard
Download the free edition: the 4-tier risk framework, a sample Vendor Security Questionnaire, and the 0–100 scoring rubric — everything you need to start tiering and reviewing your vendor list today.
Managing a Large Vendor List?
The full Premium Toolkit adds the complete 34-question VSAQ across all six sections, a fourth-party risk register for subprocessor exposure, a security contract clause library, onboarding/offboarding checklists, and a vendor score trend dashboard. See how we help small businesses manage vendor risk end-to-end.