Vendor Classification: How to Categorize Your Vendors by Risk

Vendor classification is the practice of categorizing your third-party vendors by the level of risk they introduce to your organization so you can focus your time and due diligence where it matters most. But before you can classify vendors effectively, it helps to understand just how dependent your operations have become on them and the sensitivity of the data stored, transmitted, or processed by the third party.

Think about the average user in your organization. What percentage of their time is spent using a third-party product or service? How much of their day-to-day work relies on outsourced or externally managed tools?

From hardware and network providers to operating systems, software, and support services, third-party vendors are involved at nearly every step.

Today, almost any business function can be outsourced and delivered as a cloud-based service. With so many vendors embedded in your operations, critical functions and sensitive data often depend on their secure and consistent performance. Maintaining an efficient vendor management program is essential to understanding and managing that risk.

 

What Is Vendor Classification?

Vendor classification (sometimes called vendor categorization) is the process of grouping vendors into tiers based on risk so you can apply the right level of oversight to each one. A vendor's classification is typically driven by four factors:

• The confidentiality of the information it handles
• Its access to customer information
• How critical its availability is to your operations
• The volume of assets or services it's associated with

 

The output is a simple, consistent way to answer one question: How much scrutiny does this vendor deserve?

 

What Are the Different Types of Vendors?

Organizations work with many types of vendors. While every business is different, most vendors fall into a handful of common categories:

• Technology and software vendors: Cloud and SaaS providers, hardware and networking suppliers, and managed service providers (MSPs)
• Core and data-processing providers: The systems that run day-to-day operations, especially critical for financial institutions
• Professional services vendors: Consultants, auditors, legal, and marketing partners
• Operational and facilities vendors: Cleaning, office supplies, and physical maintenance
• Staffing and outsourced labor: Contractors and third-party workforce providers

 

Organizing vendors into types first makes it easier to apply consistent risk classification across each group.

 

Common Issues with Vendor Management

Several common issues frequently arise with vendor risk assessments, mostly related to efficiency and consistency. These types of problems could cause you to spend much more time on vendor management than is reasonable:

• You may be risk assessing too many vendors too frequently. If you risk-assess more than several hundred vendors, chances are your vendor risk criteria are too broad. 
• You might struggle with how to define critical/high-priority vendors, resulting in too many "critical" vendors.
• You might have inconsistent categorization metrics, meaning multiple individuals are working on the vendor risk assessment, each following their own methods.
• You could be unsure of where to start, confused about how to manage vendors, or lost in the sea of regulation and guidance.

 

Build a Consistent Vendor Risk Categorization Process

First and foremost, you need to start with your risk assessment. You usually want to risk rate any vendors that are provide products or services that may store, transmit, or process customer or sensitive information, as well as any vendors with whom you have a current or recurring formal contract or agreement. Please note you do not have to review every single vendor.

This risk-based vendor categorization approach — rating each vendor and sorting it into a tier — is what keeps the program manageable.

SBS CyberSecurity's TRAC Vendor module uses the following metrics to prioritize vendors, assigning a high, medium, or low value for each metric per vendor:

• Confidentiality of information
• Access to customer information
• Availability
• Assets associated/volume

 

After a vendor is rated, it is placed into a category that defines the level of due diligence performed. Example categories:

• Level 1 — Critical: A core provider or host responsible for private/customer information and vital to operations
• Level 2 — Significant: A managed service provider responsible for the internal network, with intermittent access to some private information
• Level 3 — Nonessential: An office equipment vendor with no direct access to your facilities or information

 

Consistency with definitions is critical to the completion of a valuable vendor risk assessment.

 

Supplier Classification vs. Vendor Classification

You'll often see "supplier classification" and "vendor classification" used interchangeably. They describe the same practice — grouping the third parties you rely on by risk and criticality — though "supplier" is more common in procurement and manufacturing, while "vendor" is more common in IT and financial services. The framework in this article applies to both.

 

Scale Your Vendor Reviews Based on Importance

One of the biggest efficiency gains in vendor management is scaling your documentation review requirements for higher-risk vendors. The more important and critical the vendor, the more documentation you should review. 

Documents that should be requested of your most critical vendors include:

• Audited financials
• Insurance coverage
• Business continuity plan
• Incident response plan
• Business continuity plan and disaster recovery testing results
• SOC audit report
• Penetration test results
• Vulnerability assessment results
• IT audit results
• Contract documentation

 

Conversely, the less critical the vendor, the less you need to review. Vendors in the noncritical category are subject to fewer documentation requirements and a less in-depth review.

 

Keep It Simple

Most regulated organizations face similar problems with vendor management, but there are ways to make it easier:

• Scale your requirements based on criticality. Don’t burn yourself out on low-risk vendors.
  
• Almost all small and medium-sized businesses have three to eight critical vendors. If you have more, you’re probably overrating your vendors' criticality.
• Focus on repeatability and consistency with your review processes, including your risk assessments and review procedures.