VendorGate 🛡️

A complete, working third-party vendor security risk-assessment framework — questionnaire, live scoring engine, and worked vendor assessments with approve / conditions / reject recommendations.

VendorGate is the gate every third-party vendor passes through before it touches your data. Every SaaS app, cloud service, and data processor you adopt is a piece of someone else's security posture that you inherit. VendorGate is the discipline of deciding — before and during that dependency — whether a vendor gets through, on what conditions, or not at all. It ships as a usable program, not a definition: a real questionnaire, a scoring model that turns answers into a risk tier automatically, and three worked assessments that each end in an actual decision.

One-line pitch: a third-party vendor security risk-assessment framework — questionnaire, scoring model, and worked vendor assessments with approve/reject calls — the rare entry-level artifact that proves you can run vendor risk, not just define it.

---

What makes it different

Most vendor questionnaires collapse to a single weighted sum of answers → a tier. That hides two things a real program can't ignore. VendorGate fixes both:

1. Two-axis residual risk (not a flat score). It scores inherent risk (how much damage a vendor could cause — data sensitivity × access × integration) separately from control maturity (how well it defends), then combines them through a residual-risk matrix. The same weak control is Critical at a bulk-PHI processor and minor at a marketing widget — a flat score can't tell them apart. (Grounded in NIST SP 800-30.)

2. Evidence-confidence discount. A questionnaire is self-reported. Every answer is tagged Verified / Attested / Unsubstantiated, and earned points are discounted accordingly — a "yes" you can prove is worth more than one you're asked to trust.

3. Deal-breaker auto-escalators. Non-negotiable failures (no encryption at rest on regulated data, no admin MFA, an undisclosed breach) override the average — because a weighted mean can bury a single disqualifying answer.

4. It actually runs. The model is a Python engine and a live Excel workbook (verified to match cell-for-cell). Change any answer and every band, score, and tier recomputes.

The pipeline

flowchart LR
    A[1 · Intake<br/>data · access · integration] --> B[2 · Inherent Risk<br/>5 factors → Low…Critical]
    B --> C[3 · Questionnaire<br/>48 Qs · 8 domains · evidence tag]
    C --> D[4 · Control Maturity<br/>weighted + evidence discount → 0–100]
    D --> E[5 · Residual Risk<br/>Inherent × Control matrix + deal-breakers]
    E --> F[6 · Decision & Governance<br/>Approve · Conditions · Reject<br/>approver · reassessment · monitoring]
    style A fill:#3D6FB4,color:#fff
    style B fill:#5B7BB4,color:#fff
    style C fill:#6C8AB8,color:#fff
    style D fill:#4C7A8A,color:#fff
    style E fill:#B5651D,color:#fff
    style F fill:#2E7D32,color:#fff

Loading

Worked results — three contrasting vendors

Vendor	Inherent	Control (CMS)	Evidence V/A/N	Deal-breaker	Residual	Decision
AtlasCloud Infrastructure — mature IaaS	Critical	98.9 · Strong	47/1/0	—	Moderate	✅ Approve (standard conditions)
NimbusAnalytics — Series-A SaaS startup	High	51.7 · Weak	2/40/6	—	High	🟠 Approve with Conditions
DataBridge Processors — bulk PII+PHI	Critical	47.0 · Poor	0/44/4	⚠️ Yes	Critical	⛔ Reject (exec exception only)

Read the full write-ups — each shows the reasoning, the specific conditions, and the judgment calls:

• AtlasCloud — the strong vendor (why even a near-perfect critical dependency isn't "Low")
• NimbusAnalytics — the borderline call (where judgment lives: conditions, not reject)
• DataBridge — the rejection (Poor controls × Critical data × a deal-breaker)

How to use it

Assess a vendor (no code needed):

1. Open risk_scoring_model.xlsx.
2. On Inherent Risk, rate the 5 exposure factors (1–4).
3. On Scoring (or Template (blank) for a new vendor), score the 48 questions and tag each answer's evidence (V/A/N).
4. Read the Dashboard — control band, inherent band, residual tier, deal-breaker flag, and the recommended action all compute live.

Regenerate everything from source (optional):

python3 -m venv .venv && source .venv/bin/activate
pip install matplotlib openpyxl numpy
python tools/vendorgate_engine.py   # → data/results.json (the single source of truth)
python tools/build_figures.py       # → figures/*.png
python tools/build_workbook.py      # → risk_scoring_model.xlsx
python tools/build_docs.py          # → questionnaire + standards crosswalk

Repository structure

VendorGate/
├── README.md                          # you are here
├── vendor_security_questionnaire.md   # 48 questions · risk probed · options · mappings
├── risk_scoring_model.xlsx            # THE ENGINE — live, formula-driven workbook
├── assessments/                       # three worked vendor assessments (approve/conditions/reject)
│   ├── vendor_a_nimbus_analytics.md
│   ├── vendor_b_atlascloud.md
│   └── vendor_c_databridge.md
├── mapping/
│   └── standards_mapping.md           # NIST 800-161 / 800-30 / ISO 27001 / SOC 2 crosswalk
├── docs/
│   └── methodology.md                 # scope · weighting rationale · tiers · limitations
├── figures/                           # scorecards, matrix, radar, quadrant (generated)
├── data/
│   └── results.json                   # computed results — every number derives from here
├── tools/                             # reference implementation (Python)
│   ├── vendorgate_engine.py           # single source of truth for the model
│   ├── build_figures.py · build_workbook.py · build_docs.py
└── LICENSE

Grounded in recognized standards

VendorGate is a framework, not a form — every control maps to public standards. Full crosswalk in mapping/standards_mapping.md.

Standard	Role
NIST SP 800-161r1 (C-SCRM)	Supplier-risk controls (SR family) + assess→monitor lifecycle
NIST SP 800-30r1	Inherent → control → residual risk model + risk matrix
ISO/IEC 27001:2022	Annex A control mapping (incl. A.5.19–A.5.23 supplier controls)
SOC 2 (AICPA TSC)	The independent assurance vendors are scored on possessing
FedRAMP	Scored for government / high-impact regulated data

Framework structures (SIG, CAIQ) and standard control texts are paraphrased, not reproduced; consult the official publications for authoritative wording.

Data

• Real: the control expectations and structures of NIST 800-161 / 800-30, ISO 27001 Annex A, SOC 2 Trust Services Criteria, and FedRAMP — used to ground the questionnaire and the crosswalk.
• Synthetic: the three vendors, their 144 questionnaire responses, evidence tags, and resulting tiers are invented but realistic — constructed to exercise every decision path.

Author

Krishita Sanjay Choksi — sole author and maintainer. Built as a portfolio artifact for third-party / vendor risk management (TPRM).

License

MIT © 2026 Krishita Sanjay Choksi

---

_{Topics: third-party-risk · tprm · vendor-risk-management · security-risk-assessment · nist-800-161 · iso-27001 · soc2 · grc · cybersecurity · supply-chain-security · risk-scoring · security-questionnaire · vendor-assessment · infosec}