Vendor risk tiering: which suppliers deserve full due diligence

Why tier vendors at all?

A company with two thousand suppliers cannot run a full due-diligence file on each of them, and should not try. Treating every vendor the same produces one of two failures: either the review is so heavy that procurement routes around it, or it is so light that the vendor running your payroll gets the same three-page form as the one supplying stationery.

Tiering is how you spend review effort where the risk is. It is also what regulators ask for. SEBI's Cybersecurity and Cyber Resilience Framework requires regulated entities to have a third-party risk assessment process and controls "proportionate to their criticality/ risk", and RBI's outsourcing directions allow a risk-based approach to due diligence. Proportionality is not a shortcut; it is the expected design.

The output of tiering is a decision you can defend: for each vendor, which tier it sits in, which facts put it there, who approved that, and when it will be looked at again.

Which four dimensions should decide the tier?

Most tiering models that work in practice use some version of the same four dimensions. Score each one separately, with a short written reason, before combining them.

• Data access: does the vendor store, process or see personal data, confidential business information, or your systems? A vendor with admin access to a production system or a customer database is high on this axis regardless of contract value.
• Operational criticality: if the vendor stopped tomorrow, what stops with it, and how long would it take to replace? Single-source suppliers, hosting providers and anyone in a customer-facing process score high.
• Spend and financial exposure: annual value, advance payments, and how much of your cost base sits with this vendor. Spend matters, but it is the weakest predictor of risk on its own.
• Regulatory exposure: does a statute or regulator treat the vendor's activity as yours? Data Processors under the DPDP Act, material outsourcing for RBI-regulated entities and third-party service providers under SEBI's cyber framework all fall here.

How do you combine the scores into a tier?

Use the highest dimension, not an average. A low-spend analytics tool that holds your entire customer list is not a medium-risk vendor because its contract value is small. Averaging lets one high-risk fact disappear behind three low ones, and that is exactly the pattern found after an incident.

Three tiers are enough for most companies; a fourth is useful only if you have a large tail of one-off suppliers. Write the trigger for each tier as a rule someone in procurement can apply without asking legal, for example "processes personal data of customers or employees" or "no alternative supplier within thirty days".

Let the business owner propose the tier and let risk, compliance or legal approve it. The person who wants the vendor onboarded quickly should not be the only one deciding how closely it is examined. Record any override with a reason and an approver, because an undocumented downgrade is the first thing an auditor asks about.

What does each tier get?

The tiers differ in depth of review, contract terms and how often the vendor is looked at again. A workable baseline:

• Tier 1 (critical): full due diligence covering financial soundness, ownership, litigation and adverse media, information-security assessment with evidence rather than self-declaration, sub-contractors and hosting locations, business continuity and an exit plan. Contract carries audit and information rights, security obligations, breach notification, sub-contractor approval and termination assistance. Senior approval. Reviewed at least annually and on any trigger event.
• Tier 2 (elevated): a structured questionnaire with supporting documents, a targeted security or data-protection review where the vendor touches data or systems, and the relevant clause set in the contract. Reviewed on a longer cycle, such as every two years, and on trigger events.
• Tier 3 (standard): the baseline onboarding checks that every vendor gets, such as tax registration and filing status, PAN, MSME classification, bank account ownership and sanctions screening, plus standard contract terms. Re-checked on a schedule for the statutory items only.

When does the DPDP Act push a vendor into a higher tier?

If a vendor processes personal data on your behalf, it is a Data Processor under the Digital Personal Data Protection Act, 2023. Section 8(2) allows you to engage it only under a valid contract. Section 8(1) keeps you responsible for complying with the Act for processing done on your behalf "irrespective of any agreement to the contrary", and section 8(5) requires you to protect personal data through reasonable security safeguards, including for processing by a Data Processor.

The Digital Personal Data Protection Rules, 2025 make the vendor dimension explicit. Rule 6(1) lists minimum safeguards that cover processing by a Data Processor, including access controls, logging and monitoring, and retention of logs for one year, and Rule 6(1)(f) requires appropriate provision in the contract with the processor for taking reasonable security safeguards. Rule 6 comes into force eighteen months after the Rules were published in November 2025, that is in May 2027, so the obligation is close.

The practical rule for tiering: any vendor that processes personal data is at least Tier 2, and any vendor that processes it at volume, or processes sensitive categories such as financial, health or employee data, is Tier 1. You cannot evidence safeguards you never asked about.

What changes for banks and NBFCs?

For RBI-regulated entities, the regulatory-exposure dimension is not a judgement call. RBI's Managing Risks in Outsourcing Directions, 2025, issued separately for each class of regulated entity (the commercial bank directions are dated 28 November 2025), define material outsourcing, set due-diligence content, require specific contract terms and a central record of material outsourcing that is placed before the Board for half-yearly review. Material arrangements under those directions should map straight to Tier 1, and the materiality assessment the directions require becomes the evidence for that tier.

We cover the materiality criteria, contract terms and register in detail in our guide to RBI's outsourcing directions for banks and NBFCs, and do not repeat them here. The point for tiering is that the regulatory test and the internal tier should be the same record, not two assessments that can drift apart.

What does SEBI's cyber framework expect from third-party service providers?

SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF), issued by circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 on 20 August 2024, applies to SEBI-regulated entities, which it sorts into five categories ranging from market infrastructure institutions and Qualified REs down to small-size and self-certification REs. Its supply-chain standards are a direct statement of what a top tier should contain for those entities. Among other things, the framework says:

• Suppliers and third-party service providers shall be identified, prioritised and assessed using a cyber supply-chain risk assessment process, and contracts shall include measures to meet the entity's cybersecurity objectives.
• Third-party service providers performing critical activities shall be monitored and reviewed for compliance on a periodic basis, and response and recovery planning and testing shall be conducted with them.
• Responsibility, accountability and ownership of outsourced activities lie primarily with the regulated entity, and background checks, non-disclosure agreements and cybersecurity compliance are required for all third-party service providers.
• A software bill of materials (SBOM) shall be obtained for new software procurements of core and critical activities, and service-level agreements with third-party providers should stipulate timelines for closing identified vulnerabilities.
• Concentration risk from outsourcing multiple critical services to the same provider shall be assessed, with specific controls, including independent audit, for providers that pose it.

Does SEBI's framework apply the same way to every regulated entity?

No. Each CSCRF guideline carries its own applicability, and several supply-chain requirements are mandatory for all regulated entities while others, such as the concentration-risk standard, exclude small-size and self-certification entities. The original circular set adoption dates of 1 January 2025 for the six categories that already had a cyber circular and 1 April 2025 for others; SEBI has since extended those timelines for most categories and issued clarifications and an FAQ. Read the applicability column for your category, then build your Tier 1 checklist from it, rather than the other way round.

SEBI's existing outsourcing circulars continue to apply alongside the framework, which lists them in an annexure.

What should trigger a re-tier?

A tier is assigned at a point in time; vendors drift. The events that should reopen the assessment, regardless of the review calendar, are a change in the scope of services, the vendor starting to handle personal data or getting system access it did not have before, a security incident or breach at the vendor, a change of ownership or financial distress, a new sub-contractor or hosting location, and a lapsed certificate or insurance policy.

The most common failure is scope creep without re-tiering: a vendor onboarded as Tier 3 for a small pilot ends up running a core process two years later, still on its original file. Linking the vendor record to its contracts and amendments, so that a new statement of work prompts a tier check, catches most of these.

Where software helps

A tiering model lives or dies on whether it is applied the same way every time and re-run when facts change. That is a records problem more than a judgement problem. IntelloVendor supports this with configurable assessment questionnaires with scoring, review stages and sign-off, explainable risk scores, AI that reads vendor documents and pre-fills assessments for a person to review, and each vendor linked to its contracts and renewals. The tier rules, the risk appetite and the exceptions are still yours to write down first.