Evaluates one supplier, provider or partner from what you know and the evidence you hold: criticality and dependency, data exposure, security, compliance, privacy, continuity, incidents, finances and contract. Risk scores are calculated, controls count only when evidenced. It relies on the information supplied: it is no independent audit and does not verify certifications.
Contents
1. Assessment Information
2. Executive Summary
3. Assessment Scope and Methodology
4. Third-Party Profile
5. Business Relationship and Service Description
6. Business Criticality and Dependency Analysis
7. Information Access and Data Exposure
8. Information Security Assessment
9. Regulatory and Compliance Assessment
10. Data Protection and Privacy Assessment
11. Business Continuity and Disaster Recovery Assessment
12. Incident Management Assessment
13. Financial and Operational Risk Assessment
14. Contractual and SLA Assessment
15. Existing Controls and Supporting Evidence
16. Risk Identification and Analysis
17. Inherent Risk Assessment
18. Control Effectiveness Assessment
19. Residual Risk Assessment
20. Risk Findings and Identified Gaps
21. Risk Treatment Recommendations
22. Third-Party Risk Treatment Plan
23. Overall Risk Summary
24. Assessment Conclusion and Approval
25. Review and Reassessment Schedule
26. Document Version History
What you provide
Deliverable — Its title, its author and its structure are yours: they steer what is written.
Third party — Who is assessed.
Service and dependency — How much the business relies on it.
Access to systems and data — What it can reach.
Information security — What it has stated or shown.
Compliance and data protection — Certifications are stated as supplied.
Continuity and incidents — What happens when things go wrong.
Finances and contract — What protects the business.
