What is Vendor Tiering?

What is Vendor Tiering?

Vendor tiering is the practice of classifying third parties into a few tiers by the inherent risk and criticality of what they provide, so that due diligence, contracts and monitoring are proportionate to each tier.

The 2023 US Interagency Guidance on Third-Party Relationships describes the approach without using the word tier: some banking organizations assign a criticality or risk level to each third-party relationship, while others identify critical activities and the third parties that support them, and either way the key element is a sound methodology for designating which relationships receive more comprehensive oversight. It describes critical activities as those that could cause significant risk if the third party fails to meet expectations, have significant customer impacts, or significantly affect the organization's financial condition or operations. NIST SP 800-161 Rev. 1 applies the same idea to supply chain risk through criticality analysis of suppliers and the products they provide.

Why it matters

• It makes the program affordable. Tiering directs the deep work to the vendors that can hurt you.
• It is what regulators look for. Guidance from US banking agencies, DORA and the UK PRA all expect oversight scaled to criticality, not a uniform checklist.
• It drives the lifecycle. The tier decides the questionnaire, evidence, contract clauses, review cadence and sign-off.

Inputs to a tier

• Criticality of the service: does a business-critical or customer-facing process depend on it, and how quickly would an outage bite?
• Data: type and volume of personal, financial or confidential data the vendor handles.
• Access: network, system or physical access to your environment.
• Substitutability: how easily the service could be replaced.
• Regulatory exposure: whether the activity is regulated or outsourced under rules such as DORA.
• Financial exposure and reputational reach.

These inputs produce an inherent risk rating, before controls. The tier follows inherent risk, not how good the vendor seems, because the tier decides how much evidence you gather to find out.

A typical tier model

Most programs use three or four tiers. Tier 1 covers critical or high-risk vendors: full due diligence, detailed questionnaire (often SIG Core), on-site or evidence-based control review, annual reassessment, board-level reporting and an exit strategy. Tier 2 covers moderate risk: a shorter questionnaire, review of certifications such as SOC 2 or ISO 27001, reassessment every one to two years. Tier 3 covers low risk: attestation or contract-level controls, reassessment at renewal.

Keeping tiers current

A tier is a decision that decays. Scope changes, new data flows, a vendor's own outsourcing or a regulatory change can move a vendor up a tier. Rerun the tiering questionnaire at contract change and renewal, and review the criteria annually so effort keeps tracking real exposure.

Related terms

• Third-party risk management (TPRM)
• Supplier risk scoring
• Vendor due diligence
• Third-party risk
• Supplier management
• Important Business Services

In SmartSuite

SmartSuite Third-Party Risk Management calculates the inherent risk score from an intake form, assigns the tier automatically, and uses it to select the assessment template, evidence checklist, review frequency and approval route for each vendor.

Frequently asked questions

How many vendor tiers should we have?

Three is the common answer and four is the practical maximum. Each tier must map to a distinct set of due diligence, contract and monitoring requirements; if two tiers get the same treatment, merge them. The goal is a small number of clearly different oversight routines that staff can apply consistently.

Should tiering be based on inherent or residual risk?

Inherent. The tier determines how much you investigate, so it must be set before you know how strong the vendor's controls are. Residual risk, calculated after the assessment, drives the acceptance decision and any remediation, and can inform the monitoring cadence within the tier, but it should not lower the tier itself.

How does vendor tiering relate to DORA and critical or important functions?

DORA scales its requirements by whether an ICT service supports a critical or important function. A tiering model for a financial entity therefore needs a rule that places any such provider in the top tier, with the register entries, contractual provisions, concentration assessment and exit strategy that DORA requires attached to that tier.