Most third parties are never assessed
In a 2026 Ponemon survey sponsored by ProcessUnity, organizations had “an average of 2,643 third parties in their portfolio,” yet “only 36 percent of these third parties are assessed,” and “40 percent of respondents say they currently have a backlog of third-party assessments” (Ponemon Sullivan Report). Respondents averaged 12 third-party-caused incidents in the past year. Meanwhile, Verizon’s 2026 DBIR found third-party involvement in 48% of breaches (Verizon).
The answer is not to send more questionnaires. It is to assess the right vendors at the right depth. This checklist shows how.
For how to tier vendors, verify questionnaire answers and score residual risk, see Vendor Risk Assessment: Questionnaires, Evidence and Scoring.
The regulatory backbone
- Interagency Guidance (Fed, FDIC, OCC, June 2023). Organizes third-party risk management into five stages: “Planning,” “Due Diligence and Third-Party Selection,” “Contract Negotiation,” “Ongoing Monitoring” and “Termination.” It stresses that “Not all relationships present the same level of risk” and that due diligence “should be commensurate with the level of risk and complexity” (Federal Register).
- Community bank guide (May 2024). A voluntary companion for banks with $10 billion or less in assets, noting that “risk assessments are an important component of managing third-party relationships” and pointing to SOC reports, independent assessments and certifications as evidence (Federal Reserve).
- NIST CSF 2.0. GV.SC-04: “Suppliers are known and prioritized by criticality”; GV.SC-06 requires due diligence before contracting; GV.SC-07 requires monitoring “over the course of the relationship” (NIST).
- NYDFS (October 2025). Recommends tiering providers by system access, data sensitivity, location and criticality, and contract terms covering AI use of your data (NYDFS).
Tiering and scoring: inherent vs. residual risk
Score twice. Inherent risk is the exposure a vendor brings “at the start of the business relationship”; residual risk is “what remains after implementing acceptable risk mitigation measures and controls” (Prevalent, a TPRM vendor). Tier on inherent risk; decide on residual risk.
| Inherent risk factor | Low (1) | Medium (2) | High (3) |
|---|---|---|---|
| Data access | None or public | Internal business data | Regulated or customer personal data |
| System access | None | Limited, non-privileged | Privileged or network-level |
| Criticality | Easily replaced | Important, workarounds exist | Critical activity, significant customer impact |
| Subcontractors / location | None, domestic | Some, disclosed | Many or offshore, limited visibility |
A simple model: sum the factors (4–12). Score 10–12 = Tier 1 (full evidence review, annual reassessment); 7–9 = Tier 2 (standard review, every two years); 4–6 = Tier 3 (light review). The thresholds are illustrative; calibrate them to your risk appetite and document why. The interagency guidance’s description of critical activities, those that could cause “significant risk” or “significant customer impacts,” is a good anchor for Tier 1 (Federal Register).
The vendor risk assessment checklist
Organized by the interagency guidance life cycle. Due diligence topics follow the guidance’s own headings.
1. Planning
- Business need, alternatives and exit options documented
- Inherent risk scored and tier assigned
- Required evidence defined by tier
2. Due diligence and selection
- Legal and regulatory compliance, including sanctions and licensing
- Financial condition
- Business experience and key personnel
- Risk management program
- Information security: SOC 2 Type 2 or ISO 27001 certificate reviewed for scope and exceptions
- Management of information systems
- Operational resilience: business continuity and disaster recovery tested
- Incident reporting and management processes
- Physical security
- Reliance on subcontractors (fourth parties) disclosed
- Insurance coverage
- AI use: does the vendor use AI on your data, and can it train models with it?
3. Contract negotiation
- Security requirements (MFA, encryption) and right to audit
- Incident notification timelines
- Subcontractor disclosure, data location and data use, including AI training restrictions
- Termination, data return and certified destruction
4. Ongoing monitoring
- Reassessment frequency set by tier
- New SOC reports, certifications and pen test summaries reviewed when issued
- Triggers defined for out-of-cycle review: incidents, scope change, ownership change
- Residual risk and exceptions tracked to closure
5. Termination
- Access revoked across all systems
- Data returned or destroyed, including backups, with certification
Clear the backlog by reviewing evidence faster
The slowest step is reading what vendors send: an 80-page SOC 2 report, an ISO certificate and Statement of Applicability, policies and questionnaire answers. AI evidence assessment can map those documents to your checklist, flag exceptions, scope gaps and missing evidence, and cite the page behind every finding, so analysts spend their time on decisions.
Try a security evidence assessment with one Tier 1 vendor’s evidence package. AskDona shows the source behind every finding; your analysts decide.
FAQ
What should a vendor risk assessment include? The interagency guidance lists due diligence topics from legal compliance and financial condition to information security, resilience, subcontractors and insurance (Federal Register).
How do you score vendor risk? Score inherent risk to set the tier and review depth, then score residual risk after reviewing controls to make the decision.
How often should vendors be reassessed? By risk. NYDFS recommends periodic reassessment based on the “risk(s) a TPSP presents” (NYDFS).
How do we handle an assessment backlog? Tier first, so low-risk vendors get light reviews, and speed up evidence review for Tier 1 vendors.
References
All pages opened and checked by October 9, 2026.
| Source | Type | Date | Used for |
|---|---|---|---|
| Federal Register: Interagency Guidance on Third-Party Relationships | Regulator | Jun 9, 2023 | Life cycle, due diligence topics, critical activities |
| Federal Reserve: Community bank TPRM guide | Regulator | May 3, 2024 | Voluntary guide |
| NIST CSF 2.0 | Standard | Feb 26, 2024 | GV.SC-04, -06, -07 |
| NYDFS: Third-party guidance | Regulator | Oct 21, 2025 | Tiering, contracts, AI terms |
| Ponemon Sullivan Report: State of Third-Party Risk Assessments 2026 | Vendor-sponsored survey | Mar 13, 2026 | Portfolio size, backlog |
| Verizon: 2026 DBIR Executive Summary | Industry report | May 2026 | 48% third-party involvement |
| Prevalent: Inherent vs residual risk | Vendor blog | Jan 25, 2024 | Scoring definitions |