Assess Vendor Security Postures

The skill runs vendor security assessments on a risk-based methodology: classifying vendors by data-access criticality (Critical/High/Medium/Low), matching assessment depth to that tier, and evaluating five security domains - data protection and privacy, infrastructure security, application security, governance and compliance, and business continuity.

Use it to build and score a vendor assessment. The questionnaire covers governance (security frameworks followed, last third-party audit), data protection (encryption algorithms, data residency, deletion support), access management (MFA on admin access, access-review frequency), and incident response (documented plan, breach-notification timeline, cyber insurance). Scoring is quantitative and weighted:

def calculate_vendor_risk_score(assessment_data):
    # Risk factors with weighted importance
    risk_factors = {
        'data_sensitivity': {'weight': 0.25, 'score': assessment_data.get('data_score', 0)},
        'security_controls': {'weight': 0.20, 'score': assessment_data.get('controls_score', 0)},
        'compliance_status': {'weight': 0.15, 'score': assessment_data.get('compliance_score', 0)},
        'incident_history': {'weight': 0.15, 'score': assessment_data.get('incident_score', 0)},
        'business_criticality': {'weight': 0.10, 'score': assessment_data.get('criticality_score', 0)},
        'financial_stability': {'weight': 0.10, 'score': assessment_data.get('financial_score', 0)},
        'geographic_risk': {'weight': 0.05, 'score': assessment_data.get('geo_score', 0)}
    }
    
    total_score = sum(factor['weight'] * factor['score'] for factor in risk_factors.values())
    
    if total_score >= 8.0:
        return {'score': total_score, 'level': 'Low Risk', 'action': 'Standard monitoring'}
    elif total_score >= 6.0:
        return {'score': total_score, 'level': 'Medium Risk', 'action': 'Enhanced due diligence'}
    elif total_score >= 4.0:
        return {'score': total_score, 'level': 'High Risk', 'action': 'Detailed remediation plan'}
    else:
        return {'score': total_score, 'level': 'Critical Risk', 'action': 'Immediate action required'}

It is scoped to assessment and risk scoring, not to performing the vendor's remediation work itself.

Input is vendor-provided documentation (SOC 2 Type II, ISO 27001, PCI DSS or HITRUST certifications, penetration test and vulnerability scan reports, incident response playbooks, BC/DR plans, insurance certificates) plus independent technical checks - nmap/sslscan/testssl.sh against the vendor's domain, certificate-transparency lookups via crt.sh, and security-header inspection. Output is a risk score mapped to a tier and required action (standard monitoring through immediate action), plus required contract security clauses covering encryption standards, data residency, a 2-hour incident-notification window with a 72-hour detailed report, audit rights with 30 days' notice, and secure data destruction with certification on termination.

Ongoing oversight follows a monitoring schedule keyed to vendor tier - critical vendors get quarterly security reviews, weekly automated scans and continuous threat intelligence, down to annual reviews and quarterly scans for standard vendors - with defined alert triggers: new vulnerabilities, a reported incident, an expired certification, or unusual network activity.

Security and vendor-risk teams who need a consistent, evidence-backed assessment process - questionnaire, quantitative scoring, technical validation, contract requirements and a monitoring cadence - rather than a one-time checkbox review that never gets revisited.