✅ Feature availability: While the Vendors page is included with Core Third Party Risk Management, some features (like customized inherent risk scoring) may require Advanced Third Party Risk Management. Refer to Vanta Plans and Pricing for details.

Vendor risk scores help you prioritize vendors, tailor assessments (such as security assessments), and make consistent decisions across vendor onboarding, monitoring, and remediation. We calculate an inherent risk score for each vendor using your inherent risk rubric in vendor settings, and you can assign a residual risk score after you review a vendor’s assessments.

⚙️ User permissions: Editors and Admins can manage vendors and vendor settings. Learn more

Inherent risk rubric settings

Your inherent risk rubric defines how to calculate inherent risk scores. It’s made up of sections, which group related attributes. An attribute is a risk factor, like a type of data a vendor handles. You assign each attribute an inherent risk score, which we use to calculate each vendor’s inherent risk score. You also map each attribute to the vendor categories it applies to. You can start with our default rubric and edit it to fit how you assess vendors.

⚠️ Note: If auto-scoring is on, saving changes to the inherent risk rubric can recalculate the inherent risk scores of your vendors. Learn more

Editing your risk rubric

To edit your inherent risk rubric:

Go to Settings.
In the page menu, scroll to Features and select Vendors > Inherent risk rubric.
Click Edit this rubric.
Click a section to expand it and review its attributes.
To change a section:
- To edit a section, click the pencil icon next to it.
- To add a custom attribute, click the + icon next to it.
To edit an attribute:
- Click the pencil icon next to the attribute.
- In Mapped to, select the vendor categories the attribute applies to. The list includes built-in and custom categories. Learn more
- Click Done.
Click Save.

Editing custom attributes

To add a custom attribute:

Go to Settings.
In the page menu, scroll to Features and select Vendors > Inherent risk rubric.
Click Edit this rubric.
- Click a section to review the current attributes.
- Click the + icon next to the section where you want to add the attribute.
In the modal:
- Enter a Name.
- Use the Status toggle to turn the attribute on or off.
- Enter a Description.
- Select an Inherent risk score: Critical, High, Medium, or Low.
- In Mapped to, select the vendor categories the attribute applies to. The list includes built-in and custom categories.
Click Done.
Click Save.

To rename or delete an attribute, click the pencil icon next to it. Update the Name and click Done, or click Delete. Then click Save. (You cannot delete an attribute that’s connected to an automated test.)

Editing custom sections

To manage custom sections:

Go to Settings.
In the page menu, scroll to Features and select Vendors > Inherent risk rubric.
Click Edit this rubric.
In the rubric editor:
- To add a section, click Add new section.
- To rename, enable, disable, or delete a section, click the pencil icon next to it.
In the modal:
- Enter or update the section Name.
- To disable an existing section, use the Status toggle. This turns off every attribute in the section.
- To delete an existing section, click Delete. This also deletes every attribute in the section.
Click Done.
Click Save.

Inherent risk scoring

Inherent risk represents the risk a vendor poses before any mitigating controls are considered. Each vendor has an inherent risk score of Critical, High, Medium, Low, or Unscored. The score appears in the vendor detail page header, and you can filter the vendor table by it. Individual assessments do not change a vendor’s inherent risk score.

Auto-scoring

By default, each vendor is auto-scored. A vendor starts with the attributes mapped to its category in your inherent risk rubric, and you can adjust its attributes in its inherent risk score settings. The inherent risk score for a vendor is the highest inherent risk score among its attributes. Only enabled attributes count.

To see how a vendor’s inherent risk score was calculated:

From the Vendors page, open a vendor.
In the vendor header, click the inherent risk score.
- A vendor is Unscored when no attributes apply to it. To score it, select a Vendor category that’s mapped to attributes in your inherent risk rubric.
In the Configure inherent risk score modal:
- Click Scoring explanation. It lists the vendor’s category, then the attributes that apply to the vendor in each section and the inherent risk score of each. The highest inherent risk score in the list is the vendor’s overall score.
- Go to Risk attributes. It shows the vendor category and the attributes selected for each section. Select or clear attributes to customize them for this vendor. Your changes don’t affect your rubric.

⚠️ Note: Updates to the inherent risk rubric or vendor categories can change the inherent risk scores of vendors using auto-scoring:

Changing the inherent risk score for an attribute.
Adding, deleting, enabling, or disabling an attribute or section.
Changing the category a vendor is mapped to.
Deleting a category mapped to vendors. If you choose a replacement category, scores recalculate. If you clear the category, vendors become unscored.

Manual scoring

You can set a vendor’s inherent risk score yourself. A manually set score doesn’t change when you change the vendor’s category, save changes to the inherent risk rubric, or delete the vendor’s category.

To manually score vendor inherent risk:

From the Vendors page, open a vendor.
In the vendor header, click the inherent risk score.
In the Configure inherent risk score modal:
- To set a score manually, turn off Auto-score based on risk attributes. We keep the vendor’s current score until you choose a new one.
- To change a manual score, select a score under Manually set inherent risk score.
- To customize the attributes for this vendor, go to Risk attributes and select or clear attributes under each section. Your changes don’t affect your rubric.
- To go back to auto-scoring, turn on Auto-score based on risk attributes. We recalculate the score right away from the vendor’s current attributes.

ℹ️ Note: The risk matrix color palette setting also applies to vendor risk scores. You'll see either a green-to-red scale or a purple gradient, depending on your selection. Learn more

Residual risk scoring

There are two residual risk scores: one at the vendor level and one at the assessment level. You choose both manually: Critical, High, Medium, Low, or Unscored. Assessment-level and vendor-level scores are independent from each other.

Vendor-level residual risk

The vendor residual risk score is the vendor’s remaining risk after you account for its assessment findings and the controls in place. You can edit it at any time from the vendor header. You must select a score when you make a vendor decision.

Assessment-level residual risk

The assessment residual risk score is the risk remaining from that assessment’s findings and the vendor’s controls, separate from the vendor’s own residual risk score. You can edit it from the assessment header while the assessment is in progress. You must select a score to finalize the assessment when you make a recommendation.

Vendor Risk Scoring