ENISA Threat Landscape 2025 confirmed: supply-chain attacks accounted for 28% of all confirmed EU breaches — up from 12% in 2022. NIS2 Article 21(2)(d) explicitly mandates supplier risk management. SOC 2 Type 2, ISO 27001 (A.5.19-A.5.22), and most B2B contracts now require documented vendor risk assessments. This checklist is the operational tool to do it without doubling your headcount.
Not every vendor needs the same scrutiny. A 4-tier classification — based on data access, system access and operational criticality — focuses your effort where it matters.
Our checklist groups 30 questions across 6 domains. Every Tier 1 and 2 vendor must answer; auditors look for evidence of completion and your risk-acceptance decision.
Some answers should automatically eliminate a vendor regardless of price. Document each disqualification — it protects you when procurement asks why you said no.
A checklist completed once and filed is theatre. Operational vendor risk requires three things: a register, a review cadence, and a way to act on findings.
Contact us for personalized support with this issue.