03 / 11
Vendor Criticality Assessment
A tiering method that directs due diligence, monitoring and exit planning toward the third parties that matter most.
Third-party riskResilienceTiering
01 / The problem
Why the usual approach falls short
Treating every vendor the same wastes effort, while simplistic spend-based classification can miss operational concentration and customer impact.
02 / Design logic
The operating principles
- 01
Assess service dependency, data exposure, substitutability and regulatory relevance.
- 02
Distinguish criticality from the vendor's current risk performance.
- 03
Match assessment depth and oversight cadence to the assigned tier.
- 04
Make resilience, concentration and exit readiness visible to decision-makers.
03 / Intended outcome
What better looks like
A defensible basis for prioritising third-party oversight and applying proportionate controls across the vendor lifecycle.