The failure mode in vendor risk is uniformity: every supplier receives the same 300-question spreadsheet, so none receives real attention and procurement learns to route around the process.
This kit replaces that with a tiering model driven by actual exposure — data held, systems reached, privilege granted, business criticality — and four question sets calibrated to those tiers.
It also includes the contractual layer that most programmes forget: a clause library covering security, data processing, AI usage, breach notification, audit rights and sub-processor control, drafted to be negotiable rather than aspirational.
Why it is structured the way it is, and the failure patterns it was designed around.
Most SOC 2 reports are filed unread, which makes them a compliance ritual rather than assurance. Five checks any procurement or risk reviewer can run, and what each one catches.
A working risk register with a pre-populated scenario library, quantified exposure model and treatment tracking — not an empty template.
Most organisations discover their first real gap during an audit or an incident. The assessment surfaces it in fifteen minutes instead — scored, benchmarked and prioritised, with nothing to buy.
Built for
Kept current
Version 2.4, revised 2 June 2026. We update when a framework changes, when new rules are notified, or when an engagement teaches us something that improves it.
XLSX + DOCX · 46 pages
What this will not do
A template cannot know your systems, test your controls or make the judgement calls that determine whether a programme holds up in an audit. Use it to move faster, not to skip the thinking — and treat any resource claiming to make you compliant on its own as a warning about its author.
Boards do not fund amber. Calibrated estimation produces defensible loss-exposure ranges from expert judgement — here is the method and its failure modes.
Uniform assessment means no vendor gets real scrutiny. Tier by what the vendor can actually reach, then vary depth — including the questions AI vendors need that nobody asks.
A DPDPA-conformant notice set — customer, employee, vendor and website — with itemised processing tables and multilingual structure built in.
The technical specification for consent that actually propagates — data model, event schema, versioning rules and downstream enforcement patterns.
Your position across privacy, security, governance, risk and AI accountability, scored against sector benchmarks rather than a generic scale.
The specific gaps that matter most for your sector and size, ordered by risk reduction rather than by framework clause number.
Where you stand against DPDPA, ISO 27001, ISO 42001 and SOC 2 — and which of them your buyers are most likely to ask for next.
No sales call required to see your results. Take it, read the output, and decide independently whether you want to talk to anyone.
