Vendor security risk assessment
vendor_risk_assessmentRead-onlyIdempotent
Use when an organisation evaluates a supplier, SaaS or ICT provider (vendor due diligence, third-party risk, supply chain security under NIS2 Art. 21(2)(d) or DORA). Call without input to get the questions. Call with the vendor profile (type, criticality, data access, regimes) and answers (yes, partial, no, unknown) to get a risk score, risk level, monitoring tier and the gaps.
Tool call template
This tool declares no required parameters. Add optional parameters from the input schema as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {},
"name": "vendor_risk_assessment"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| bcp1 | No | Does the vendor have a business continuity / disaster recovery plan? | |
| bcp2 | No | Does the vendor offer a defined SLA with uptime guarantees? | |
| bcp3 | No | Can data be exported/migrated if you terminate the relationship? | |
| bcp4 | No | Does the vendor have geographic redundancy for critical services? | |
| bcp5 | No | Is the vendor financially stable (no signs of distress)? | |
| com1 | No | Is the vendor compliant with GDPR (if processing EU personal data)? | |
| com2 | No | Will the vendor sign a Data Processing Agreement? | |
| com3 | No | Does the vendor provide right-to-audit or access to audit reports? | |
| com4 | No | Does the vendor's contract include security requirements and SLAs? | |
| com5 | No | Does the vendor have adequate insurance coverage (cyber liability)? | |
| inc1 | No | Does the vendor have a documented incident response plan? | |
| inc2 | No | Will the vendor notify you of security incidents within 24-48 hours? | |
| inc3 | No | Has the vendor experienced any data breaches in the last 3 years? | |
| inc4 | No | Does the vendor conduct incident response exercises/tabletop tests? | |
| sec1 | No | Does the vendor hold relevant security certifications (ISO 27001, SOC 2, etc.)? | |
| sec2 | No | Does the vendor have a documented information security policy? | |
| sec3 | No | Does the vendor encrypt data at rest and in transit? | |
| sec4 | No | Does the vendor enforce multi-factor authentication? | |
| sec5 | No | Does the vendor conduct regular penetration testing? | |
| sec6 | No | Does the vendor have a vulnerability management program? | |
| sec7 | No | Does the vendor perform background checks on employees with data access? | |
| sup1 | No | Does the vendor disclose its key subprocessors/subcontractors? | |
| sup2 | No | Will the vendor notify you before changing subprocessors? | |
| sup3 | No | Does the vendor assess the security of its own suppliers? | |
| sup4 | No | Are subprocessor contracts held to the same security standards? | |
| regimes | No | Which of these apply to your organization? (optional) | |
| dataAccess | No | What data will this vendor access? | |
| vendorType | No | Type of service | |
| criticality | No | How critical is this vendor to your operations? |