Vendor Risk Assessment

Detects completed vendor risk assessments: third-party risk assessment wording with populated vendor/contract fields and inherent/residual risk ratings, supported at high confidence by assurance evidence. Topic wording alone is discovery-only.

Type

regex

Confidence

medium

Confidence justification

Medium confidence: the topic phrase alone is discovery-only; enforcement needs populated structure (a populated vendor field (vendor/supplier, ABN, contract number/value, service, data types, criticality, assessor, owners) or a populated risk rating (inherent/residual/overall/control risk with a level or score)), and 85 needs two distinct structures plus independent assurance-evidence (questionnaire response, SOC 2/ISO certificate, pen test, subprocessors, data residency) evidence, so policies, blank forms and training text stay below 75.

Jurisdictions

global

Regulations

Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth), Security of Critical Infrastructure Act 2018 (Cth)

Frameworks

DISP, ISO 27001, NIST CSF

Data categories

security, governance

Scope

narrow

Risk rating

4

Should match

• Vendor risk assessment — Discovery probe (65) - title only
• Vendor risk assessment: inherent risk high and residual risk medium. — Medium-tier probe (75) - populated risk ratings
• Third-party risk assessment - payroll SaaS Vendor: Tidewater Payroll Pty Ltd Contract number: HH-2026-044 Data types: employee bank details, TFNs Inherent risk: High; residual risk: Medium SOC 2 report reviewed; subprocessor list and data residency (Sydney) confirmed; remediation plan for MFA gap. — High-tier probe (85) - vendor fields, ratings and assurance evidence

Should not match

• Vendor booth at the market — Non-match
• Best vendor award ceremony — Non-match
• The public procurement page links to a vendor risk assessment. — Public link mentions only the title
• Template example: vendor risk assessment with inherent risk high, security questionnaire response, and data handling controls. — Template contains otherwise high-tier evidence
• Policy statement: a vendor risk assessment is completed before any contract that involves personal information. — Policy text
• Vendor risk assessment form Vendor: ________ Inherent risk: [insert] — Blank form

Known false positives

• Procurement pages linking to a blank vendor risk assessment form. Mitigation: Blank fields and template/guidance framing are excluded; 85 needs vendor fields, a rating and assurance evidence.

References

• Privacy Act 1988 (Cth)
• Information Privacy Act 2009 (Qld)
• Security of Critical Infrastructure Act 2018 (Cth)
• Information Security Manual (ISM)
• CPS 230 Operational Risk Management