0 / 24

Model 48 of 74 · Cybersecurity

Third-Party Security Maturity Assessment

Assess how well your organisation evaluates, monitors, and manages security risk from third-party vendors and services.

Pillars & areas

Assess

Evaluate the risk

  1. 01Vendor Risk Assessment
  2. 02Continuous Monitoring

Monitor

Watch for changes

  1. 03SaaS & Cloud Vendor Governance
  2. 04Fourth-Party & Concentration Risk

Govern

Control the exposure

  1. 05Contractual Security & Access Control
  2. 06Third-Party Incident Response

Levels

  1. 1Trust-AssumedTrust by contract alone
  2. 2Risk-AssessedTiered & evidence-based
  3. 3Continuously VerifiedReal-time trust validation

01 Vendor Risk Assessment

Does the organisation evaluate third-party security posture before granting access to data or systems?

0/4 answered

VR-1How does your organisation decide which vendors need a security assessment?

Think about whether all vendors are treated the same, or whether the depth of assessment depends on what data or systems they will access.

VR-2What evidence does your organisation collect to assess a vendor's security posture?

Consider whether you rely on the vendor's word alone, or whether you request certifications, audit reports, or test results.

VR-3How does your organisation handle vendors that do not meet your security requirements?

Think about what happens when a vendor fails the assessment — is there a process for remediation, risk acceptance, or rejection?

VR-4How does your organisation manage the security assessment process across its vendor portfolio?

Consider whether assessments are tracked centrally, or whether each department handles vendor security independently.

02 Continuous Monitoring

Does the organisation track vendor security posture over time, or does it rely solely on point-in-time assessments?

0/4 answered

CM-1How does your organisation monitor changes in vendor security posture after onboarding?

Think about whether you check on a vendor's security only at contract renewal, or whether there is ongoing visibility.

CM-2What triggers a reassessment of an existing vendor's security posture?

Consider whether reassessment only happens on a fixed schedule, or whether events like breaches or scope changes also trigger a review.

CM-3How does your organisation use external threat intelligence to inform vendor risk decisions?

Think about whether you track news of vendor breaches or vulnerabilities, or whether you only learn about problems when the vendor tells you.

CM-4How does your organisation track the overall health of its third-party risk programme over time?

Consider whether you have metrics or reporting that show whether vendor risk is improving, stable, or deteriorating across your portfolio.

03 SaaS & Cloud Vendor Governance

Does the organisation have visibility and control over the security implications of its SaaS and cloud vendor footprint?

0/4 answered

SG-1How well does your organisation know which SaaS applications are in use across the business?

Think about whether you have a complete inventory of SaaS tools, or whether teams adopt new services without IT or security awareness.

SG-2How does your organisation assess the security of SaaS platforms before adoption?

Consider whether there is a security review before a new SaaS tool is approved, or whether anyone can sign up and start using a service.

SG-3How does your organisation manage security configurations in its SaaS and cloud platforms?

Think about whether anyone checks that security settings in SaaS tools (MFA, sharing permissions, API access) are configured correctly.

SG-4How does your organisation control what data is stored in and shared through SaaS platforms?

Consider whether there are rules about what types of data can be uploaded to which SaaS tools, and whether this is enforced.

04 Fourth-Party & Concentration Risk

Does the organisation understand the hidden dependencies and concentration risks behind its direct vendor relationships?

0/4 answered

FR-1How much visibility does your organisation have into its vendors' sub-processors and key dependencies?

Think about whether you know which cloud providers, hosting services, or other third parties your vendors rely on to deliver their service to you.

FR-2How does your organisation assess concentration risk across its vendor portfolio?

Consider whether you know if multiple critical vendors all depend on the same cloud provider, payment processor, or infrastructure service.

FR-3How does your organisation respond when a fourth-party provider experiences a security incident?

Think about what happens when a cloud provider or infrastructure service that your vendors depend on is breached — can you assess your exposure quickly?

FR-4How does your organisation factor fourth-party risk into vendor selection and ongoing governance?

Consider whether the sub-processors behind a vendor influence your decision to use them, or whether this is never discussed.

05 Contractual Security & Access Control

Are security expectations formalised in vendor agreements, and is vendor access to the organisation's environment properly controlled?

0/4 answered

CA-1How does your organisation embed security requirements into vendor contracts?

Think about whether contracts include specific security obligations, or whether they only cover commercial terms.

CA-2Does your organisation have the right and ability to audit its vendors' security practices?

Consider whether you can actually verify what a vendor tells you about their security, or whether you rely entirely on their self-reported information.

CA-3How does your organisation manage the access that vendors have to its systems and data?

Think about whether vendor accounts are provisioned with the same care as employee accounts, or whether they get broad access that is never reviewed.

CA-4How does your organisation handle security obligations when a vendor relationship ends?

Consider whether there is a defined offboarding process that ensures data is returned or destroyed and access is revoked.

06 Third-Party Incident Response

Can the organisation detect, respond to, and recover from security incidents that originate at or involve third parties?

0/4 answered

TI-1How quickly would your organisation know if one of its vendors experienced a security breach?

Think about whether you rely on the vendor to tell you, or whether you have other ways of finding out.

TI-2Does your organisation have a plan for responding to a vendor security incident?

Consider whether there is a documented process for what to do when a vendor is breached, or whether the response would be improvised.

TI-3How does your organisation assess its own exposure when a vendor is compromised?

Think about whether you can quickly determine what data or systems a breached vendor had access to.

TI-4How does your organisation use lessons from vendor security incidents to improve its third-party risk programme?

Consider whether anything changes after a vendor incident, or whether the same gaps persist.

Self-assessment report

Third-Party Security

Answer the questions above and your report builds here: an overall score, a score and target for each area, and the three changes that matter most.

About this model

About the Third-Party Security maturity model

Your security perimeter no longer ends at your firewall. Every vendor with access to your data, every SaaS platform your teams adopt, and every sub-processor behind the scenes extends your attack surface in ways you may not see. The most damaging breaches of the past decade have not come through the front door — they have arrived through trusted third parties whose security posture was assumed rather than verified. Organisations that treat vendor onboarding as a procurement checkbox and never look again are building their defences on foundations they have never inspected.

Third-party security maturity is about replacing assumption with evidence. At the lowest level, trust is granted by contract alone — a signature on a data processing agreement is treated as proof of security. At the highest level, trust is continuously earned through real-time risk signals, evidence-based assessments, and the ability to detect when a vendor's posture changes before it becomes your incident. This model focuses specifically on the security risk dimension of third-party relationships — not commercial performance, not delivery quality, but whether the organisations you depend on can protect what you have entrusted to them.

The Third-Party Security maturity model assesses six areas that together cover the full lifecycle of vendor security risk — from initial assessment and onboarding through to ongoing monitoring, incident coordination, and the often-invisible risks of fourth parties and concentration. It is designed for any organisation that relies on external vendors, SaaS platforms, or cloud services, regardless of whether you have a dedicated third-party risk function or manage vendor relationships informally. The 24 questions describe three levels of maturity through concrete, observable behaviours rather than aspirational statements.

Who this assessment is for

  • CISOs and security leaders responsible for third-party risk programmes
  • Procurement and vendor management teams who need to embed security into onboarding
  • Risk and compliance professionals assessing supply chain exposure
  • IT leaders managing SaaS sprawl and shadow IT across the organisation
  • Business owners who sponsor vendor relationships and need to understand their security obligations
  • Consultants and auditors evaluating an organisation's third-party security posture

The three maturity levels

  • Level 1 — Trust-Assumed: Third-party security is not formally assessed. Vendors are onboarded based on business need and contractual terms alone, with no evidence of their security posture requested or reviewed. The organisation has no visibility into how vendors handle its data, no process for monitoring vendor risk over time, and no plan for responding to a vendor breach. Trust is implicit — granted at contract signature and never revisited.
  • Level 2 — Risk-Assessed: The organisation evaluates vendor security before onboarding using a risk-based approach. Vendors are tiered by the sensitivity of data and systems they access, higher-risk vendors undergo structured assessment, and contracts include enforceable security requirements. Periodic reviews check that vendors continue to meet expectations, and there is a defined process for handling vendor security incidents. The organisation knows which vendors matter most and has evidence to support its trust decisions.
  • Level 3 — Continuously Verified: Trust is maintained through ongoing evidence, not periodic snapshots. The organisation monitors vendor security posture in near real-time using external risk ratings, threat intelligence, and automated alerting. Fourth-party dependencies and concentration risks are mapped and managed. Vendor breach response is rehearsed and coordinated, and the organisation can rapidly assess its exposure when a vendor is compromised. Security is treated as a living condition of every third-party relationship, not a gate passed once at onboarding.

The 6 areas assessed

1. Vendor Risk Assessment

How the organisation evaluates the security posture of third parties before granting access to data or systems. This area covers whether vendors are tiered by risk, whether assessments are evidence-based or rely on self-attestation alone, and whether the depth of evaluation matches the sensitivity of the relationship.

2. Continuous Monitoring

Whether the organisation tracks vendor security posture over time or relies solely on point-in-time assessments. This area examines ongoing monitoring mechanisms, reassessment triggers, the use of external risk signals, and whether changes in a vendor's security posture are detected before they become incidents.

3. SaaS & Cloud Vendor Governance

How the organisation manages the security implications of SaaS adoption and cloud vendor relationships. This area covers visibility into sanctioned and unsanctioned SaaS usage, configuration review, data handling practices, and whether security teams have oversight of the growing SaaS footprint.

4. Fourth-Party & Concentration Risk

Whether the organisation understands the dependencies behind its direct vendors — the sub-processors, hosting providers, and shared infrastructure that create hidden risk. This area assesses visibility into fourth-party relationships, concentration risk analysis, and the ability to evaluate cascading failures when a single provider underpins multiple vendors.

5. Contractual Security & Access Control

How security expectations are formalised in vendor agreements and how vendor access to the organisation's environment is controlled. This area covers security clauses, right-to-audit provisions, vendor access provisioning, and whether access is governed with the same rigour applied to internal users.

6. Third-Party Incident Response

How the organisation detects, responds to, and recovers from security incidents that originate at or involve third parties. This area examines breach notification requirements, coordinated response procedures, exposure assessment capabilities, and whether the organisation has rehearsed its response to a vendor compromise.

How this model relates to other frameworks

This is an original, simplified maturity model and is not derived from or intended to replace any of the following. However, organisations that use this assessment may also find value in these established frameworks:

  • NIST SP 800-161r1 — Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations
  • ISO/IEC 27036 — Information security for supplier relationships (Parts 1-4)
  • SIG (Standardized Information Gathering) Questionnaire — Shared Assessments' vendor risk assessment tool
  • NIST Cybersecurity Framework (CSF) 2.0 — includes supply chain risk management as a core function
  • SOC 2 Type II — widely used as evidence of vendor security controls and operational effectiveness

Frequently asked questions

What is the Third-Party Security maturity model?

Assess how well your organisation evaluates, monitors, and manages security risk from third-party vendors and services. It is an original, simplified model with three maturity levels (Trust-Assumed, Risk-Assessed and Continuously Verified), assessed through 24 questions across 6 areas: Vendor Risk Assessment, Continuous Monitoring, SaaS & Cloud Vendor Governance, Fourth-Party & Concentration Risk, Contractual Security & Access Control and Third-Party Incident Response.

How long does the Third-Party Security assessment take?

Most people finish in 10–14 minutes. Each of the 24 questions has three concrete answer options. Your progress is saved in the page URL, so you can bookmark it and come back later.

How is the score calculated?

Each answer scores 1 (Trust-Assumed), 2 (Risk-Assessed) or 3 (Continuously Verified). An area's score is the average of its answered questions, and the overall score is the average of the area scores, so every area counts equally. Scores run from 1.0 to 3.0.

Is my data stored or shared?

No. Your answers are never sent to a server. They are stored only in the page URL, which you control. Copy the link to share results with colleagues, or export a PDF or CSV report.

How should I use the results?

Start with "Where to focus" in your report. It lists the questions with the biggest gap to the target you set for each area, and shows what the next level looks like in practice. For a fuller picture, ask several people from different teams to complete the assessment and compare their links. Differences in perception are often as revealing as the scores themselves.