Vendor Risk Tiering Simulator
Six vendors, six very different data-access levels. Tier them correctly and decide who needs a full security review.
Six vendors with very different levels of access to your data. Tier them and decide who needs a full security review — because reviewing everyone equally means reviewing everyone badly.
How to use it
- Review what data each vendor touches.
- Assign a tier based on access and criticality.
- Decide the depth of review each tier warrants.
What to take away
Tier by data access and criticality
A vendor holding customer records is a different problem from one supplying office snacks. Spend the review budget accordingly.
Fourth parties count
Your vendor's vendors touch your data too. Concentration risk hides one layer down, where everyone turns out to depend on the same provider.
Onboarding is not the end
Access grows, products change, companies get acquired. Tiering needs periodic review or it describes a company that no longer exists.
Frequently asked questions
What decides a vendor's tier?
Sensitivity of data accessed, whether they connect to your systems, how badly their outage hurts you, and any regulatory exposure their failure creates.
Is a SOC 2 report enough assurance?
It is evidence, not a verdict. Read the scope, the period covered, and especially the exceptions — a clean report on a narrow scope can say very little about what you care about.
Where this fits in the course
This security lab pairs with Path 23 — GRC & Compliance — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Compliance Control Mapper — Look up how one control area maps across SOC 2, ISO 27001, NIST 800-53, and PCI-DSS.
- Risk Register Builder — Add risks with likelihood and impact, get an auto-scored severity, and export the register as Markdown.
- Incident Response Tabletop — A branching ransomware scenario. Make the containment and communication calls a real incident commander has to make under pressure.
- Dependency / SBOM Risk Checker — Paste a dependency list and flag ones matching a known-vulnerable version range.