Vendor Tiering

What is vendor tiering?

Vendor tiering is sorting your vendors into groups by how much risk they bring, so you spend the most review time on the ones that matter most. A vendor that holds customer data gets a deep, frequent review. A design tool with no data gets a light one.

NIST's Cybersecurity Framework says "Suppliers are known and prioritized by criticality" (GV.SC-04). Its quick-start guide suggests ranking by factors such as the sensitivity of data the supplier handles and its access to your systems. No standard sets the exact tiers, so you choose them and write them down.

Three tiers work for most small companies:

• Tier 1 (high): holds customer personal data, has access to production systems, or your product stops without it.
• Tier 2 (medium): holds internal or employee data, or would cause real disruption if it went down.
• Tier 3 (low): no sensitive data, easy to replace.

Why it matters to you

You cannot review 80 tools in depth every year. Tiering tells you where to look. It also gives an auditor a reason for why some vendors got less attention. One workable model: Tier 1 gets a full review every year and whenever its terms change in a way that matters, Tier 2 gets a lighter refresh, and Tier 3 just gets its tier confirmed.

A tier is not permanent. A low-tier tool becomes high-tier the day someone uploads customer data to it, or the day it adds an AI feature that uses your content.

What to check

• Every vendor in your vendor inventory has a tier and a short reason for it.
• The criteria are written down in your vendor management policy.
• Each tier has a review depth and how often, both in plain words an auditor can test.
• Something triggers a re-tier: a new data type, a new AI feature, or a new subprocessor.

Critical Vendor

A critical vendor is one you cannot operate without, or one whose failure would seriously hurt your customers. For a SaaS company, that usually means your cloud host, your database or authentication provider, your payment processor, and any tool that holds most of your customer data.

The US bank regulators' 2023 guidance uses a similar test for "critical activities": activities that could cause significant risk if the third party fails, have significant customer impacts, or significantly affect the bank's operations. Those get the most oversight. The same idea scales down well.

For critical vendors, go further than Tier 1:

• Know how you would keep running for a day without it, and how you would move off it. See vendor lock-in.
• Read its SLA and service credits closely.
• Watch its terms and subprocessors continuously, not just yearly.
• Check whether several critical vendors depend on the same provider (concentration risk).

How Venpo helps

Venpo watches the legal pages of every vendor you add, so your Tier 1 and critical vendors get continuous coverage between reviews. When one changes its terms, DPA or subprocessor list, you get a plain-English email with what changed and why it matters.