Vendor Security Assessment

Assessing third-party vendors manually is slow and prone to missing critical security gaps. This skill automates the vendor risk management lifecycle, from initial tiering to scoring complex security questionnaires.

What it does

• Vendor tiering categorizes providers based on data sensitivity, network access, and business criticality to determine assessment depth.
• Questionnaire generation produces tier-appropriate security assessments ranging from 25 to 55 questions across 13 security domains.
• Automated scoring evaluates vendor responses with a focus on detecting high-risk red flags like missing MFA or lack of encryption.
• Evidence review provides structured logic for analyzing SOC 2 Type II reports, ISO certificates, and penetration test summaries.
• Remediation planning translates identified gaps into specific contract clauses and required security controls.

How it works

1. Use the tier command to define the vendor profile and required evidence levels based on data and access types.
2. Generate a questionnaire CSV file tailored to the vendor tier to be sent for completion.
3. Run the score command on the returned vendor file to identify red flags and calculate risk ratings.
4. Review the generated Markdown assessment for approval recommendations and necessary contract schedules.

Frameworks & tools

This tool relies on a Python-based CLI for processing assessments. It maps findings against industry standards like SOC 2, ISO 27001, and common security governance frameworks.

Why this beats prompting it yourself

Generic prompts often miss the nuance of how specific failures, like a lack of breach notification commitments, should override a high numerical score. This skill enforces a structured risk methodology that ensures critical red flags are never buried by "yes" answers in less important categories.

Use cases

• Tiering a new SaaS provider to see if they require a full SOC 2 review.
• Generating a customized 55-question security deep dive for a Tier 1 vendor.
• Scoring a completed vendor questionnaire to flag missing MFA or encryption.
• Drafting security-specific contract clauses based on a vendor's reported gaps.

Known limitations

Requires vendor responses in a specific CSV format. Does not perform automated scanning of vendor endpoints; relies on self-reported data and provided audit documentation.