Free checklist
Which of your vendors are critical?
An eight-step checklist from Third Party Threat Hunting (TPTH). Start with one question about consequence, and finish with a short list of critical vendors you can justify in one sentence.
The eight steps
Ask them in this order
A systemically critical vendor is one that, if diminished or offline, impacts us nearly as much as losing our own systems.
1. Consequence
If this vendor is diminished or offline, are we hit nearly as hard as losing our own systems?
Exposure · Decides membership · Ask: the business owner
2. Reduced service
Does slow, partial or intermittent service hurt us, not only a full outage?
Exposure · Decides membership · Ask: the business owner
3. Interdependence
What sits underneath this vendor, and does any other vendor of ours share it?
Exposure · A flag, not a tier · Ask: the vendor, plus our vendor list
4. Tabletop-tested
Have we practiced working without it, for slow service as well as an outage?
Readiness · What we owe it · Ask: the relationship owner
5. In front of leadership
Is it reported to the board and leadership on a regular schedule?
Readiness · What we owe it · Ask: the risk lead
6. Check yearly
Do we re-answer this test every year, and after any major change?
Readiness · What we owe it · Ask: the risk lead
7. Aware of the data
Does it handle sensitive data? What flows to it, by what path, and where does it go next?
Exposure · Sets the tier if sensitive · Ask: the vendor, plus our own team
8. Limited list
Can we justify it in one sentence, and is the list still a handful?
Readiness · The brake · Ask: leadership
For each step the checklist gives you what a Yes sounds like, what a No sounds like, a place to note the evidence you hold, and who to ask. Practice guidance, not a regulatory standard or legal advice.
How the answers sort a vendor
Two rules, and one reminder
How critical is it?
Consequence and Reduced service both Yes: systemically critical. Consequence Yes, Reduced service No: critical. Consequence No but it handles sensitive data: critical for data reasons. Anything else: ordinary, normal monitoring. Interdependence is a flag, not a tier: if two or more of our vendors share what sits underneath it, screen that provider too. A ? on an exposure question counts as Yes until it is answered.
How ready are you to lose it?
For a systemically critical or critical vendor, two or more No answers on Tabletop-tested, In front of leadership, Check yearly and Limited list means a readiness review. Leadership sees it with a decision: fund the fallback, run the tabletop, or accept the gap in writing with an owner and a date. One No: continue, with a written condition that has an owner. A ? on a readiness question counts as No until it is answered.
This checklist scores how your organization depends on a vendor, not how good the vendor is. The same vendor can be systemically critical to one organization and ordinary to another, which is why a published list of “critical vendors” cannot do your thinking for you. Start with your own consequence.
Get the checklist
Free, with your work email
We email the PDF straight away.
The checklist is on its way
The checklist is on its way to your inbox. If it does not arrive within a few minutes, check your spam folder.
What happens next
The checklist arrives by email within a few minutes, as a PDF you can print or fill in. That is the only email you get for it.
We keep your email address, and the optional details you give, to send the checklist and to follow up on a call if you ask for one. No tracking of opens or clicks. Privacy Notice →