Vendor Score: Impact Score

The Impact Score is one of the vendor scores. It is based on how much impact your vendor relation has to your company. It evaluates how your organization interacts with the vendor, regardless of their security posture, in order to determine how much risk/impact this vendor poses to your organization, omitting any controls.

See the default Impact Score categories.

Configuration Recommendations

Configure your Impact Score based on your business processes, or your third party risk management program. Impact Score categories must add up to 100%:

• If you do not want to include any of the out-of-the-box categories, simply assign 0% weight to it.
• To add new custom categories, select +Add, enter the category name, its definition, and then select Submit.
• You may assess each vendor on these criteria using:
  • 3 step selector (Low, Medium, High)
  • 5 step selector (Very Low, Low, Medium, High, Very High)
  • 1-100%

Default Impact Score Categories

• Ease of Replacement: Use Ease of Replacement to evaluate and indicate how easily you could replace this third party product or service with others.
• Legal and Regulatory Requirements: Use Legal and Regulatory Requirements to analyze the applicable legal and regulatory requirements of your company information that will be shared with the third party being evaluated.
• Criticality of Service: Criticality of Service rates how critical the provided service or product is to your company.
• Type of Information: Use Type of Information to rate the importance of the information (from your company) that this third party will possess or have access to.
• Volume of Information: Score Volume of Information based on the volume of sensitive company information the third party will possess or have access to.
• Size of Commitment: Size of Commitment considers the overall cost, agreement, and number of users to measure the size of your company’s commitments.