Supply Chain Risk Assessor

Supply Chain Risk Assessor — Score Vendors Against NIST SP 800-161

Third-party compromise is now one of the most reliable routes into an organisation, and the reason is structural: your security programme covers your systems, while your exposure covers everyone your systems trust. This supply chain risk assessor lets you build a vendor inventory, score each supplier through a structured questionnaire, weight that score by tier, data access and geography, and then look at the portfolio as a whole for the concentration risks that individual vendor scores never reveal.

It produces a scored vendor register, a concentration risk analysis, a criticality-versus-risk portfolio quadrant, a prioritised remediation plan, and a PDF report framed against the NIST SP 800-161 process. Everything runs in your browser with no account and no data leaving your device.

What the Tool Does

• Organisation profile — name, industry, vendor count band, current C-SCRM maturity (ad-hoc, developing, defined, managed, optimizing) and the frameworks you are aligning to: NIST 800-161, CMMC, ISO 28000, C-SCRM or SOC 2.
• Vendor assessment — for each vendor: tier, category, criticality, level of data access, geographic risk, whether a qualified alternative exists, and an eight-domain questionnaire.
• Concentration analysis — single points of failure, category concentration, geographic concentration and tier over-classification, each with severity and a specific recommendation.
• Dashboard — portfolio scatter of criticality against risk score, so the vendors in the high-criticality, high-risk quadrant become obvious.
• Remediation priorities — vendors ranked by the combination of risk and criticality, with their specific weak domains and the actions that address them.
• Export — a PDF containing the profile, register, concentration findings, quadrant summary, remediation plan and a Frame/Assess/Respond/Monitor status readout.

The Eight Assessment Domains

Each vendor is rated across the eight areas that most reliably predict whether a supplier will become your incident:

1. Security certifications — SOC 2 Type II, ISO 27001 and equivalents, and whether you have actually read the report rather than noted the badge. The exceptions section of a SOC 2 report is where the useful information lives.
2. Incident response capability — documented plan, tested, with contractual notification timelines you can live with.
3. Financial stability — an underrated security control. A vendor in financial distress cuts the security team first.
4. Subcontractor and fourth-party management — who your vendor trusts, and whether they know. This is the domain most often scored generously and most often wrong.
5. Business continuity planning — recovery objectives that match your dependency on them, not their internal comfort.
6. Patch management and vulnerability handling — remediation SLAs by severity, disclosure process, evidence of meeting them.
7. Data protection practices — encryption, segregation, retention and deletion on exit.
8. Contractual security requirements — whether your security expectations are enforceable terms or an email thread.

How the Risk Score Works

A questionnaire average alone treats a commodity supplier with no data access the same as a critical vendor holding your customer records. The score here corrects for that: the domain average is multiplied by a tier multiplier, a data-access multiplier and a geographic factor, then capped at 10.

Scores of 7.5 and above are Critical, 5.5 to 7.4 High, 3.5 to 5.4 Medium, and below 3.5 Low. Treat the numbers as a consistent way to rank a portfolio, not as an actuarial estimate — the value is in ordering the queue, and the ordering is only as good as the honesty of the questionnaire answers.

Why Concentration Risk Deserves Its Own Section

A portfolio in which every vendor scores 3.0 can still be dangerously fragile. Concentration risk is the failure mode that per-vendor scoring cannot see, and the tool checks four kinds:

• Single points of failure — a critical vendor with no identified alternative. The remedy is not a better questionnaire; it is a qualified second source and a tested contingency plan.
• Category concentration — more than half your suppliers in one category, so one category-wide event takes out a majority of your supply base at once.
• Geographic concentration — several critical vendors operating in the same high-risk region, which converts a regional event into an organisational one.
• Tier concentration — an implausible number of vendors labelled Tier 1. Sometimes that is real dependency; more often it means tiering was done without criteria, and everything urgent became critical.

Concentration is also where fourth-party risk bites. Two vendors that look independent to you may sit on the same hosting region, the same identity provider or the same upstream logistics carrier. The questionnaire’s subcontractor domain is the only place that surfaces, which is why a low score there deserves more attention than its weight suggests.

NIST SP 800-161 in Practice

NIST Special Publication 800-161 Revision 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, is the reference the export is framed against. It addresses the risk that products and services contain malicious code, are counterfeit, or carry vulnerabilities introduced by poor development or manufacturing practice, and it prescribes a multilevel approach rather than a single vendor checklist — C-SCRM has to operate at the enterprise level, at the mission and business process level, and at the operational system level, because a decision made in procurement determines what the system owner is later stuck with.

The risk management process it inherits from the wider NIST risk framework has four steps, and the report reports status against each:

• Frame — establish the risk context: who you are, what you make, what a supply chain failure would actually cost you. Without this, risk appetite is undefined and every finding looks equally urgent.
• Assess — evaluate suppliers and dependencies against that context. This is the vendor questionnaire work.
• Respond — decide and act: accept, mitigate, transfer or avoid. The remediation priorities view is the input to this step.
• Monitor — continuous rather than annual. Vendor risk changes when the vendor is acquired, breached, downgraded or quietly moves your data to a new region.

Related requirements you may be picking up simultaneously: CMMC Level 2 draws its requirements from NIST SP 800-171 and includes supplier flow-down obligations; SOC 2 addresses vendor and business partner risk under the CC9 criteria; and ISO 28000 covers security management for the supply chain more broadly.

Frequently Asked Questions

Is this a substitute for a vendor risk management platform?

No. Continuous monitoring platforms pull external attack surface data, breach intelligence and certificate telemetry that no questionnaire can produce. This tool is for the structured internal judgement layer: turning what you know about your suppliers into a ranked, defensible portfolio view. Many organisations need both; almost all need this one first.

Is any of this legal or contractual advice?

No, it is an informational aid. Contractual security requirements, flow-down obligations and regulatory supplier duties depend on your agreements and your sector. Have counsel review anything you intend to put into a contract.

How many vendors should I assess?

Start with everything in Tier 1 and anything with significant or full access to sensitive data, regardless of tier. That is usually 10–30 suppliers for a mid-sized organisation and covers the large majority of realistic exposure. Assessing 400 commodity suppliers first is how vendor risk programmes stall.

What counts as fourth-party risk?

Your vendors’ vendors. A payroll provider using an offshore development contractor, a SaaS platform running on a single cloud region, an MSP reselling another firm’s SOC. You cannot assess them directly, so you assess whether your vendor manages them — contractual flow-down, subcontractor inventory, notification on change.

How often should assessments be refreshed?

Annually as a baseline, quarterly for Tier 1, and immediately on a trigger event: an acquisition, a publicly disclosed breach, a material service change, or the loss of a certification you relied on. That is the Monitor step, and it is the one most programmes skip.

What if a critical vendor scores badly and cannot be replaced?

Then you are managing a risk rather than fixing one. Tighten what you can control: reduce the data they hold, segment their access, add contractual notification and audit rights, build a tested contingency plan, and record the acceptance decision with a named owner and a review date. Documented acceptance is a legitimate outcome; undocumented acceptance is what an incident report calls negligence.

Does the tool send my vendor list anywhere?

No. All assessment data stays in your browser, and the PDF is generated locally.

What should I run alongside this?

For the maturity of the vendor management programme itself rather than the individual suppliers, use the VRM breach-proof scorecard. For software supply chain specifically, generate and review a bill of materials with the SBOM generator. To convert risk rankings into financial terms for a budget discussion, the quantitative risk analysis tool and the risk matrix calculator handle the SLE, ARO and ALE arithmetic.