Give the most attention to relationships whose failure or misuse could cause the most serious harm to your operations, customers, information or obligations. Start with the service you actually use. Vendor size, annual spend and a familiar brand are poor substitutes for that judgment.
Use four questions to make the first cut
- What could stop or go wrong? Identify the business process, customer impact and tolerance for disruption or incorrect work.
- What can the provider reach? Include sensitive information, payment authority, system access and physical access where relevant.
- How hard would replacement be? Consider migration time, usable exports, specialist knowledge and realistic alternatives.
- What makes the dependency wider? Look for shared infrastructure, key subcontractors and several teams relying on the same service.
These are practical screening questions, not a prescribed scoring model. Add requirements specific to your industry, contracts and use case.
Separate importance from control quality
A service can remain critical even when its controls are strong. Keep the consequences of failure visible separately from the concerns left after you evaluate controls. Otherwise, a reassuring report may incorrectly move an essential service to the bottom of the oversight queue.
Consider two examples. A low-cost authentication service can block nearly everyone from working if it fails. A higher-cost supplier of easily replaced materials may have a much smaller immediate effect. Reviewing only the largest purchases would reverse the attention these relationships deserve.
Turn the tier into actual work
Define what each tier changes:
- Who approves the service and any remaining risk.
- What evidence the review needs.
- Which issues require escalation.
- When to revisit the decision.
A readily replaceable, low-impact service may need only a short documented review. A critical service may justify deeper recovery evidence, dependency questions and a workable contingency.
Record the reason for the tier in one or two sentences. Revisit it when the service gains new data, privileges, users or responsibilities. An unchanged vendor name does not mean an unchanged risk.
For cybersecurity dependencies, NIST SP 1305 offers a starting point for establishing supply-chain risk management and communicating supplier requirements. Its scope is cybersecurity; the business-impact questions above intentionally extend beyond that scope.
Explore the Third-party Risk guide for related questions and practical approaches.