Vendor assessment: criteria, weighting and an Excel template
Assess vendors using relevant criteria, weighted responses and knockout conditions. Free Excel template with instructions and a worked example.
A vendor has a security policy, creates backups and names a contact. Is that enough for your relationship? The answer depends on the service, the data involved and the access the vendor receives.
A vendor assessment makes that decision traceable. You define criteria, review responses and evidence, and record open issues. This template helps you start assessing a service provider's information security.
Download the vendor assessment Excel template – no registration required. It includes a blank working sheet, a fictional example and instructions. Formulas calculate the result from your inputs; weights and thresholds are editable.
Start with the service and its context
A provider accessing production customer data needs different checks from a supplier without system access. Before sending questions, identify the service and dependent business process, the information and access involved, the reviewer and follow-up owner, and the assessment and next review dates.
Criticality and risk rating answer different questions. Criticality describes the importance of a service. The assessment describes security gaps in its context. A critical provider may have strong safeguards; a small provider may still have extensive access.
Ten criteria to adapt
The template contains ten information-security questions. It is not a general purchasing questionnaire covering price, product quality or delivery performance.
| Criterion | What to establish | Example weight |
|---|---|---|
| Access rights | Access limited to required systems and data | 3 |
| Authentication | MFA for privileged and remote access | 3 |
| Privacy | Required contracts and processing locations clarified | 3 |
| Information security | Documented responsibilities and policies | 2 |
| Backups | Backups and restoration tested | 3 |
| Continuity | Outage response and service recovery arrangements | 2 |
| Incidents | Notification channels, contacts and response times | 2 |
| Sub-suppliers | Relevant sub-suppliers and services identified | 2 |
| Security evidence | Relevant current evidence or audit reports | 1 |
| Exit | Data return, deletion and access revocation | 2 |
Adapt the questions to the service. A certificate can provide useful evidence, but check whether its scope covers what you buy and whether it answers the specific question.
Weight responses and calculate the score
The workbook uses a 0–5 scale. Zero means explicitly not met. A missing response stays blank. The instructions describe intermediate levels for planned, partially implemented and evidenced requirements.
Weighted points = response points × weight
Fulfilment score = total weighted points ÷ total maximum points
Weight 0 removes a question from scoring. Record why it does not apply. An unanswered active question or invalid input prevents a complete rating. The template accepts whole-number points and weights from 0 to 5.
The example thresholds are low risk from 80%, moderate from 60%, and high below 60%. These are editable example rules, not ISO 27001 requirements or statistical incident probabilities. A high score reflects only the criteria you assessed.
Keep knockout conditions separate
Some prerequisites cannot be compensated for by good answers elsewhere. Mark them before sending the questionnaire. In this template, “Knockout: Yes” combined with 0 points triggers a separate finding that overrides the normal category.
The spreadsheet does not reject a vendor automatically. Your team must decide whether to change the service, require remediation or stop the relationship.
The fictional “ExampleCloud” assessment earns 69 of 115 possible points, or 60%. Authentication receives 0 points and is marked as a knockout criterion. The result therefore reads “Review knockout”, although the aggregate score would fall into the moderate band.
Turn findings into follow-up work
Assign each relevant gap a question or measure, an owner, a deadline and supporting evidence. Review whether the response changes your decision. Schedule a currentness review too: services, sub-suppliers and access can change after the original assessment.
Our vendor risk management guide covers the broader programme. This article focuses on the criteria and calculation for one assessment.
When the spreadsheet becomes limiting
The workbook does not send surveys, remind vendors or coordinate your team's tasks. It is useful for an initial assessment and agreeing a method. With many assessments, sending questions, chasing replies and maintaining versions becomes a separate workload.
Vendor assessments in Kopexa send surveys with reminders and support configurable response-based risk ratings. Your team reviews flagged answers and follows up in the vendor's context. Third-party risk management connects that work with risks, tasks and supplier relationships.
Frequently asked questions
Is there one formula for every vendor assessment?
This formula is a traceable starting point. Criteria, weights, scales and thresholds need to fit the service. Evaluating quality or delivery performance may require a different method.
Does a missing response trigger a knockout?
No. A missing response remains open. A knockout requires a previously marked criterion and an answer explicitly scored zero.
Does the rating approve the vendor?
No. It structures the assessment. The relationship decision, conditions and accepted risks remain a separate documented step.
Quellen
- NIST SP 800-161 Rev. 1, Update 1 [Abgerufen am ]