Assess Vendor Security Postures

This is a vendor security assessment skill for third-party risk management, structuring evaluation around five key domains - data protection and privacy, infrastructure security, application security, governance and compliance, and business continuity - assessed at a depth matched to each vendor's criticality tier (Critical/High/Medium/Low, based on data access level). It includes a standard security questionnaire covering information security governance, data protection, access management, and incident response, and quantifies risk with a weighted scoring model:

def calculate_vendor_risk_score(assessment_data):
    # Risk factors with weighted importance
    risk_factors = {
        'data_sensitivity': {'weight': 0.25, 'score': assessment_data.get('data_score', 0)},
        'security_controls': {'weight': 0.20, 'score': assessment_data.get('controls_score', 0)},
        'compliance_status': {'weight': 0.15, 'score': assessment_data.get('compliance_score', 0)},
        'incident_history': {'weight': 0.15, 'score': assessment_data.get('incident_score', 0)},
        'business_criticality': {'weight': 0.10, 'score': assessment_data.get('criticality_score', 0)},
        'financial_stability': {'weight': 0.10, 'score': assessment_data.get('financial_score', 0)},
        'geographic_risk': {'weight': 0.05, 'score': assessment_data.get('geo_score', 0)}
    }
    
    total_score = sum(factor['weight'] * factor['score'] for factor in risk_factors.values())
    
    # Risk level classification
    if total_score >= 8.0:
        return {'score': total_score, 'level': 'Low Risk', 'action': 'Standard monitoring'}
    elif total_score >= 6.0:
        return {'score': total_score, 'level': 'Medium Risk', 'action': 'Enhanced due diligence'}
    elif total_score >= 4.0:
        return {'score': total_score, 'level': 'High Risk', 'action': 'Detailed remediation plan'}
    else:
        return {'score': total_score, 'level': 'Critical Risk', 'action': 'Immediate action required'}

Use this skill when running a formal third-party security assessment - it names concrete evidence to collect (SOC 2 Type II, ISO 27001, PCI DSS, or HITRUST certifications; penetration-test and quarterly vulnerability-scan reports; incident-response playbooks; cyber-liability insurance certificates) and gives command-line validation techniques (nmap, sslscan, testssl.sh, a certificate-transparency lookup against crt.sh, and a security-headers check via curl) to independently verify a vendor's claims rather than relying only on their questionnaire answers. It also specifies contract clauses to require - a 2-hour incident-notification timeline, 72-hour detailed incident reports, annual audit rights, 30-day secure data destruction on termination - and a continuous-monitoring cadence that scales with vendor tier (quarterly reviews and weekly automated scans for critical vendors, down to annual reviews and quarterly scans for standard vendors). It is not a one-time checklist - the framework assumes ongoing monitoring after initial assessment, so it isn't suited for a single pass-fail vendor approval with no follow-up.

Input is a vendor's questionnaire responses, certifications, and independently-collected scan and validation evidence; output is a weighted risk score mapped to a risk tier (Low/Medium/High/Critical) with a corresponding recommended action, required contract security clauses, a documentation checklist, and a monitoring schedule with named alert triggers - new vulnerabilities discovered, a reported security incident, an expired compliance certification, or unusual network activity.

Uses nmap, sslscan, and testssl.sh for network and TLS validation, crt.sh for certificate-transparency lookups, and references named compliance frameworks and certifications - SOC 2 Type II, ISO 27001, PCI DSS, HITRUST, NIST - as evidence standards.

Security, procurement, and legal teams running third-party vendor risk assessments who want a tiered, evidence-based methodology with a quantified risk score and ongoing monitoring, rather than a one-time subjective questionnaire review.