Which tier is this vendor?
Four questions about a vendor give you its inherent risk, its tier and the documents to ask for. It takes about a minute, and nothing you enter leaves the page.
- 1Answer four questionsCriticality, data, role and regions.
- 2See the tierThe answers add up to a score from 0 to 100.
- 3Get the document listWhat to request before the review starts.
Business criticality
What happens to your operations if this vendor stops delivering?
How the tier is set.
Each answer carries points. The total is the inherent risk score, and the score sets the tier.
| Score | Inherent risk | Tier | Review |
|---|---|---|---|
| 0 to 29 | Low | Tier 4 | Basic checks, reassessed every 36 months |
| 30 to 59 | Medium | Tier 3 | Light review, reassessed every 24 months |
| 60 to 79 | High | Tier 2 | Standard review, reassessed every 12 months |
| 80 and above | Critical | Tier 1 | Deep review, reassessed every 12 months |
- Low+5
- Moderate+12
- High+22
- Critical+30
- None+0
- Internal+10
- Personal+20
- Special category+30
- Supplier+5
- Processor+12
- Integrated+16
- Outsourced function+20
- UK only+5
- UK and EU+10
- US, UK and EU+15
- Global+20
Questions about the calculator
Short answers. For anything else, write to us.
It uses the same questions, weights and bands as the Add vendor flow in the demo workspace. In your own workspace a reviewer confirms the tier, and can change it with a reason.
An information security policy and an anti-bribery policy are asked of every vendor, whatever the tier.
GDPR, UK DPA, CCPA, ISO 27001, SOC 2 and financial risk. You can add your own policies as well.
No. The calculator runs in your browser and sends nothing.
Run the full assessment on a real vendor.
Open a demo workspace with a sample vendor, its documents and its findings. Or bring your own vendor to a 30-minute call.