Book a Discovery Call
📋 Paid Template

Vendor Risk Assessment Template

A comprehensive, practitioner-built framework for evaluating third-party and supplier security posture. ISO 27001 and SOC 2 aligned. Used by compliance teams to satisfy Annex A third-party requirements.

✓
150+ questions across 10 risk domains
✓
Automated risk scoring matrix
✓
Risk tier classification (Critical / High / Medium / Low)
✓
Editable Excel format — customise to your needs
✓
ISO 27001:2022 Annex A 5.19–5.22 aligned
✓
SOC 2 third-party management aligned
✓
Instant download on purchase
Purchase Template — $149 → Ask a question
One-time purchase
$149
Individual licence · Instant download
✓Complete Excel workbook
✓150+ assessment questions
✓Automated risk scoring
✓Vendor summary dashboard
✓Risk register export
✓ISO 27001 evidence ready
✓Lifetime access to updates
✓Email support included
Purchase Now — $149 →

Secure checkout via Gumroad · Instant download after payment

What's included

Everything you need for vendor risk management.

Built by security practitioners for compliance teams — not a generic checklist, but a structured framework used in real advisory engagements.

📊

Risk Scoring Matrix

Automated scoring calculates an overall vendor risk rating based on responses. Vendors are classified as Critical, High, Medium, or Low risk — no manual calculation required.

📋

150+ Assessment Questions

Comprehensive questions covering information security, data protection, business continuity, access management, incident response, and compliance obligations.

📈

Vendor Dashboard

A summary dashboard showing each vendor's risk score, tier classification, assessment date, and open findings — giving management a clear view of third-party risk posture.

📁

Risk Register Export

Automatically populated risk register from assessment findings — ready to include in your ISO 27001 ISMS documentation or board reporting pack.

✏️

Fully Editable

Every question, scoring weight, and risk threshold is editable. Customise the template to match your organisation's risk appetite and supplier categories.

🔄

Lifetime Updates

As we update the template to reflect new regulatory requirements or framework changes, you receive the updated version at no additional cost.

Assessment domains

10 risk domains. 150+ questions.

Every domain is weighted by risk level. Critical and high-risk domains carry greater weight in the overall vendor risk score.

01
Information Security Governance
Security policies, ISMS, certifications (ISO 27001, SOC 2), executive accountability for security
15 questions
02
Access Control and Identity Management
User access provisioning, MFA, privileged access, access reviews, offboarding procedures
18 questions
03
Data Protection and Privacy
Data handling practices, encryption, NDPA/GDPR/PIPEDA compliance, data processing agreements
20 questions
04
Network and Infrastructure Security
Network segmentation, firewall controls, vulnerability management, penetration testing
15 questions
05
Cloud Security
Cloud provider certifications, shared responsibility model, data residency, cloud configuration management
12 questions
06
Incident Response
Incident response plan, breach notification procedures, response time commitments, past incident history
14 questions
07
Business Continuity and Resilience
BCP/DR plans, RTO/RPO commitments, backup procedures, disaster recovery testing
12 questions
08
Physical Security
Data centre controls, physical access management, visitor management, environmental controls
10 questions
09
Personnel Security
Background checks, security training, acceptable use, NDA agreements, subcontractor management
12 questions
10
Compliance and Audit
Regulatory compliance, audit rights, right to audit clauses, certifications and attestations
12 questions
→
ISO 27001 Annex A 5.19–5.22 Compliance
Use the template to satisfy information security in supplier relationships requirements and generate evidence for your certification audit.
→
SOC 2 Vendor Management
Document third-party risk assessments to satisfy SOC 2 Trust Services Criteria requirements for vendor management controls.
→
NDPA Third-Party Processor Assessment
Assess data processors handling Nigerian personal data in compliance with NDPA 2023 third-party obligations.
→
Annual Vendor Review Programme
Use as the basis for an annual vendor security review programme — send to suppliers, collect responses, and track risk over time.
→
New Vendor Onboarding
Incorporate into your procurement process to assess new vendors before signing contracts or sharing data.
Who is this for

Built for compliance and procurement teams.

🏦

Financial services and fintech

Satisfy CBN, OSFI, and PRA third-party risk requirements with a structured, documented assessment framework.

💻

SaaS and technology companies

Meet SOC 2 and ISO 27001 vendor management requirements with a template that generates audit-ready evidence.

🏥

Healthcare organisations

Assess vendors handling health data against NDPA, GDPR, and HIPAA third-party obligations.

🔒

Security and compliance teams

A practitioner-built framework you can deploy immediately — no need to build from scratch.

Ready to strengthen your third-party risk programme?

Purchase the Vendor Risk Assessment Template and deploy it immediately — or book a discovery call if you need advisory support building a full vendor risk management programme.

Purchase Template — $149 → Book a Discovery Call