design-vendor-risk-assessment

Design Vendor Risk Assessment

Establish an ongoing program to assess and monitor a critical third-party vendor's operational, security, financial, and compliance risk — rather than evaluating the vendor once at contract signing and never revisiting the assessment, even as the vendor relationship, the vendor's own condition, and the organization's dependence on it all evolve over time.

Why This Is Best Practice

Adopted by: NIST Special Publication 800-161, "Cybersecurity Supply Chain Risk Management Practices," documents structured vendor and supply-chain risk assessment as a required discipline for organizations managing third-party dependencies, and ongoing vendor risk management (VRM) programs — as distinct from one-time vendor due diligence — are standard practice across procurement, security, and operational risk functions in organizations that depend on critical third-party vendors. Impact: A vendor assessed as low-risk at the point of contract signing can become significantly riskier over time — its financial condition can deteriorate, its security practices can weaken, its compliance posture can lapse, or the organization's own dependence on it can deepen — and an organization that only assessed the vendor once, at signing, has no mechanism to detect this drift before it results in an actual disruption or failure. Why best: A one-time vendor evaluation captures only a snapshot of the vendor's risk profile at a single point in time, while the actual risk the organization bears from the relationship accumulates and changes continuously over the life of the engagement — an ongoing monitoring program is specifically designed to detect this drift, providing warning and time to react before a vendor's deteriorating condition results in an actual failure affecting the organization.

Sources: NIST Special Publication 800-161, "Cybersecurity Supply Chain Risk Management Practices"; standard vendor/third-party risk management (VRM) industry practice