When your Third-Party Risk Management (TPRM) program treats every vendor the same, you're either over-investing in low-risk relationships or under-managing critical ones. You need a structured way to segment your vendor population and allocate resources proportionally to actual risk.
This template provides a vendor risk tiering matrix you can deploy immediately. It's designed to categorize vendors into four tiers based on inherent risk factors and assign appropriate oversight activities to each tier.
What This Template Does
The vendor risk tiering matrix establishes clear criteria for classifying third parties and defines the corresponding assessment frequency, control requirements, and monitoring activities for each tier. You'll use it to:
- Assign every vendor to a specific risk tier based on objective criteria.
- Determine which vendors require annual assessments versus lighter-touch reviews.
- Justify resource allocation decisions to auditors and executive leadership.
- Identify when a vendor's risk profile changes and requires tier reassignment.
This isn't a scoring algorithm. It's a decision framework that translates qualitative risk factors into actionable tiering decisions.
Prerequisites
Before you implement this matrix, ensure you have:
- A complete vendor inventory with basic metadata (service type, contract value, data access level).
- Authority to define tiering criteria from your risk committee or equivalent governance body.
- Baseline assessment templates for each tier (you'll reference these in the matrix).
- Access to vendor contracts to verify data processing terms and service criticality.
If you're operating under DORA, identify which vendors meet the ICT third-party service provider definition. For ISO 27001 compliance, ensure your tiering aligns with Annex A control 5.19 (information security in supplier relationships).
The Vendor Risk Tiering Matrix
TIER 1: CRITICAL
Criteria:
□ Processes, stores, or transmits [special categories of data](/glossary/special-categories-of-data)
□ Provides services where disruption would halt core business operations
□ Has direct access to production systems or network infrastructure
□ Falls under regulatory definition of critical service provider (e.g., DORA ICT provider)
□ Contract value exceeds $[threshold based on your organization's materiality]
Activities:
- Annual comprehensive assessment (SIG Standard or equivalent)
- Quarterly ongoing monitoring (financial health, breach notifications, control changes)
- Annual on-site or virtual audit rights exercise
- Executive-level business continuity plan review
- Continuous threat intelligence monitoring
- Incident response plan integration testing
TIER 2: HIGH
Criteria:
□ Processes or stores confidential business data (not special categories)
□ Provides services where disruption would significantly impact operations but workarounds exist
□ Has access to non-production systems or limited network segments
□ Contract value between $[mid-threshold] and $[high-threshold]
Activities:
- Annual targeted assessment (SIG Lite or domain-specific questionnaire)
- Semi-annual ongoing monitoring
- Right to audit clause in contract (exercised on risk-based schedule)
- Annual business continuity attestation
- Breach notification requirements with 24-hour SLA
TIER 3: MODERATE
Criteria:
□ Processes only public or internal-use data
□ Provides services where disruption would cause inconvenience but not material impact
□ No direct system access (SaaS tools with SSO integration only)
□ Contract value between $[low-threshold] and $[mid-threshold]
Activities:
- Biennial lightweight assessment (vendor-provided security documentation review)
- Annual ongoing monitoring (public breach databases, news monitoring)
- SOC 2 Type II report review (if available)
- Standard contract security terms
TIER 4: LOW
Criteria:
□ No data processing (physical goods, one-time services)
□ Service disruption has negligible business impact
□ No system access of any kind
□ Contract value below $[low-threshold]
Activities:
- Initial vendor screening only (basic due diligence questionnaire)
- Passive monitoring (no scheduled reviews)
- Standard contract terms
How to Customize This Matrix
Start by setting your contract value thresholds. These should reflect your organization's size and risk appetite. For example, a mid-market financial services firm might set Tier 1 at contracts exceeding $500K annually, Tier 2 at $100K-$500K, Tier 3 at $25K-$100K, and Tier 4 below $25K. Your thresholds will differ.
Next, adjust the data classification criteria to match your data processing register. If you're subject to GDPR, "special categories of data" has a specific meaning (Article 9). If you're operating under different privacy frameworks, substitute your equivalent Special Categories of Data definitions.
The activity frequencies are starting points. If your risk committee determines that Tier 2 vendors warrant annual monitoring instead of semi-annual, document that decision in your TPRM policy and update the matrix accordingly.
For vendors that meet multiple tier criteria, always assign the highest applicable tier. A $50K contract vendor that processes special categories of data goes in Tier 1, not Tier 3.
Validation Steps
Once you've customized the matrix, validate it against your existing vendor population:
Run a pilot classification. Take 20 representative vendors and assign them to tiers using your criteria. If more than 40% land in Tier 1, your criteria are too broad. If fewer than 5% are Tier 1, you're likely missing critical vendors.
Map to regulatory obligations. Cross-reference your Tier 1 and Tier 2 vendors against regulatory requirements. Under DORA's digital operational resilience testing requirements, your critical ICT service providers must participate in threat-led penetration testing. Confirm those vendors appear in Tier 1.
Calculate resource requirements. Multiply the number of vendors in each tier by the annual hours required for their assigned activities. If the total exceeds your team's capacity by more than 20%, you need to either adjust tier criteria, modify activity frequencies, or request additional resources.
Test edge cases. Identify vendors that don't fit cleanly into your criteria (consider a team managing a low-value contract that suddenly gains access to production data mid-term). Document the escalation process for tier reassignment when risk profiles change.
Audit the audit rights. Review your Tier 1 and Tier 2 contracts to confirm you actually have the audit rights and SLAs specified in the matrix. If 30% of your Tier 1 vendors lack audit clauses, you've identified a contract remediation project.
This matrix won't eliminate vendor risk. It will ensure you're directing your limited assessment capacity toward the relationships that actually matter. When your next audit asks how you prioritize third-party oversight, you'll have documentation that shows clear criteria, consistent application, and risk-based resource allocation.
