Last updated: 25 October 2026
Quick answer: Third-party risk tiering sorts your vendors into a small number of risk levels, usually three or four, based on how much damage they could cause if they failed or were breached. Each tier then gets a defined depth of due diligence, contract terms, monitoring and review frequency, so effort goes where risk is highest.
Most organisations rely on hundreds of suppliers. Sending every one the same long questionnaire is slow, while treating them all lightly leaves the vendors that matter under-examined.
Third-party risk tiering solves that problem. This guide covers tiering criteria, a scoring model you can adapt, what each tier should trigger, a worked example, and how EU, UK and US regulators expect you to prioritise.
What is third-party risk tiering?
Third-party risk tiering is the step in a third-party risk management (TPRM) programme that classifies each vendor by its inherent risk before you decide how closely to assess and monitor it. It answers one question: how bad would it be if this supplier failed, was breached or disappeared tomorrow?
Tiering is based on inherent risk, meaning the risk created by the relationship itself before you consider the vendor’s controls. A payment processor holding card data is high inherent risk even if it has excellent security. Its controls affect residual risk, which you measure later through the assessment that the tier triggers.
Frameworks already expect this. The NIST Cybersecurity Framework 2.0 includes subcategory GV.SC-04, “Suppliers are known and prioritized by criticality” (NIST CSWP 29, February 2024). ISO 27001:2022 Annex A controls 5.19 to 5.22 on supplier relationships also assume you apply requirements proportionate to the risk each supplier presents.
Why does vendor tiering matter?
Tiering lets a small team apply deep scrutiny to the few vendors that could seriously hurt the organisation while keeping onboarding fast for everyone else.
Regulators also write proportionality into their rules:
- US banking. The June 2023 Interagency Guidance on Third-Party Relationships from the Federal Reserve, FDIC and OCC says banks should apply “more comprehensive and rigorous oversight” to relationships supporting higher-risk activities, including critical activities.
- EU financial sector. DORA separates ICT services that support critical or important functions from all others, and requires extra contractual provisions for the former.
- EU essential and important entities. NIS2 requires entities to consider the vulnerabilities specific to each direct supplier and service provider when putting supply chain security measures in place.
Common mistake: Tiering by contract value. A low-cost SaaS tool that syncs your customer database can carry far more risk than an expensive facilities contract. Spend is a useful secondary signal, not a primary criterion.
Which criteria should drive third-party risk tiering?
Use five to seven criteria that describe impact, not vendor quality. The most useful ones are data sensitivity, system access, operational criticality, substitutability, regulatory relevance and concentration.
1. Data sensitivity and volume
Does the vendor store or view personal, special category, card, health or confidential data, and how much of it?
2. System and network access
Can the vendor connect to your network, hold privileged credentials, push code or updates, or administer your cloud tenant?
3. Operational criticality
Would a failure stop a key business service or regulated activity? Link this to your business impact analysis.
4. Substitutability and exit difficulty
How long would it take to replace the vendor or bring the service in-house?
5. Regulatory and contractual relevance
Does the service fall under a specific regime, such as ICT services supporting a critical or important function under DORA, a material third-party arrangement for UK regulated firms, or a business associate relationship under HIPAA?
6. Concentration and fourth parties
Do several of your critical services depend on the same provider or the same underlying cloud? Does the vendor rely on subcontractors you cannot see?
How do you build a vendor tiering model?
Ask a short intake questionnaire when a vendor is requested, score each criterion from 1 to 3, and map the total, plus a few automatic overrides, to a tier. Keep the intake to 10 to 15 questions so business owners actually complete it.
Scoring model you can adapt
| Criterion | 1 (low) | 2 (medium) | 3 (high) |
|---|---|---|---|
| Data sensitivity | No personal or confidential data | Limited personal or internal data | Special category, card, health or large-scale personal data |
| System access | None | Standard user access or one-way data feed | Privileged, network or code/update access |
| Operational criticality | No impact on key services | Degrades a key service | Stops a key or regulated service |
| Substitutability | Replaceable within weeks | Replaceable within months | Very hard to replace or exit |
| Regulatory relevance | None | Indirect (e.g. supports reporting) | Directly in scope of a regime (DORA, HIPAA, PCI DSS) |
| Concentration | Single, isolated use | Used by several teams | Several critical services depend on it |
Tier thresholds and overrides
- Tier 1 (critical): total 15 to 18, or any automatic override.
- Tier 2 (high): total 11 to 14.
- Tier 3 (moderate): total 8 to 10.
- Tier 4 (low): total 6 to 7.
Automatic overrides push a vendor straight to Tier 1 regardless of score. Typical overrides are: supports a critical or important function under DORA, holds privileged access to production, or processes special category data at scale.
In practice: Calibrate thresholds against 20 or 30 vendors you already know well before rolling out. If your payroll provider lands in Tier 3, the weighting is wrong, not the provider.
What should each vendor tier trigger?
Each tier should trigger a predefined package of due diligence, contract clauses, monitoring and reassessment frequency. The table below is a starting point, not a regulatory requirement; adjust frequencies to your risk appetite.
| Activity | Tier 1 | Tier 2 | Tier 3 | Tier 4 |
|---|---|---|---|---|
| Due diligence | Full questionnaire, evidence review, possible on-site or virtual audit | Full questionnaire plus certifications (ISO 27001, SOC 2) | Short questionnaire | Basic checks only |
| Contract terms | Audit rights, incident notice, exit plan, subcontracting controls | Security schedule, incident notice, DPA if relevant | Standard security and DPA clauses | Standard terms |
| Ongoing monitoring | Continuous signals, quarterly service reviews | Annual review, alerts on incidents | Event-driven | None beyond renewal |
| Reassessment | Annually and on material change | Every one to two years | Every two to three years | At renewal |
| Exit planning | Documented and tested exit strategy | Documented exit approach | Not required | Not required |
| Approval | Risk committee or CISO | Risk and business owner | Business owner | Procurement |
If you want to run intake questionnaires, tiering rules and reassessment reminders in one place instead of spreadsheets, you can start your 14-day free trial of Enactia’s AI-powered GRC platform and test the workflow on your own vendor list.
Worked example: tiering three vendors
Here is how the model above scores three common suppliers for a mid-sized insurer.
| Vendor | Scores (data / access / ops / subst. / reg. / conc.) | Total | Tier |
|---|---|---|---|
| Cloud policy administration platform | 3 / 3 / 3 / 3 / 3 / 2 | 17 | Tier 1 (also DORA override) |
| Marketing email service with customer contact data | 2 / 2 / 1 / 1 / 1 / 1 | 8 | Tier 3 |
| Office catering supplier | 1 / 1 / 1 / 1 / 1 / 1 | 6 | Tier 4 |
The marketing tool may still need a GDPR data processing agreement, even at Tier 3. Tiering decides the depth of security review; it does not remove legal requirements that apply to every processor.
How do EU, UK and US rules shape vendor tiering?
None of these regimes prescribes a four-tier model, but each defines a category of relationships that needs heavier oversight. Your top tier should at least capture those.
| Region | Key rule | Category needing more oversight |
|---|---|---|
| EU (financial) | DORA, Regulation (EU) 2022/2554 | ICT services supporting critical or important functions (Articles 28 and 30) |
| EU (cross-sector) | NIS2, Directive (EU) 2022/2555 | Direct suppliers and service providers (Article 21(2)(d) and 21(3)) |
| UK (financial) | PRA SS2/21 and FCA PS26/2 | Material outsourcing and material third-party arrangements |
| US (banking) | Interagency Guidance, June 2023 | Third parties supporting critical activities |
EU: DORA and NIS2
DORA has applied since 17 January 2025. Article 30(3) lists extra contract terms for ICT services supporting critical or important functions, including full service levels, business contingency testing, unrestricted audit rights and exit strategies with a transition period. DORA also requires every financial entity to keep a register of information on all ICT contracts, which our DORA register of information guide covers in detail.
UK: material arrangements
For UK banks, insurers and other regulated firms, the PRA’s supervisory statement SS2/21 already expects a materiality assessment of outsourcing and other third-party arrangements. The FCA’s PS26/2, published on 18 March 2026, adds a requirement for in-scope firms to notify new or significantly changed material third-party arrangements and to submit an annual register, with the rules applying from 18 March 2027. A clear Tier 1 definition makes both far easier.
US: critical activities
The interagency guidance describes critical activities as those that could cause significant risk if the third party fails, have significant customer impact, or significantly affect the bank’s financial condition or operations.
How do you keep tiers accurate over time?
Re-tier a vendor whenever its scope changes, not only at renewal. The classic failure is a Tier 3 tool that quietly gains access to production data after a new integration.
- Add a “scope change” trigger to procurement and change management.
- Feed incidents, breaches and adverse news into an automatic tier review.
- Review concentration across your whole Tier 1 list at least annually.
- Report tier counts and overdue reassessments to the risk committee.
Tiering results should also flow into your enterprise risk management register, so a Tier 1 vendor with weak controls appears as a recorded risk with an owner and treatment plan. For wider context on why boards now care, see our article on why vendor risk is now an executive liability.
How can software support third-party risk tiering?
Software helps most with consistency: the same intake questions, scoring logic and reassessment dates for every vendor, while your risk team owns the logic. A vendor and third-party risk management module can hold intake forms, tiering rules and evidence, while cross-framework control mapping lets one Tier 1 assessment answer DORA, NIS2, ISO 27001 and NIST CSF questions at once instead of four times.
Key takeaways
- Tier vendors on inherent risk: data, access, operational criticality, substitutability, regulatory relevance and concentration.
- Use a simple 1 to 3 score per criterion plus automatic overrides for regulated or privileged relationships.
- Each tier must trigger a defined package of due diligence, contract terms, monitoring and review frequency.
- Make sure your top tier captures DORA critical or important functions, UK material arrangements and US critical activities.
- Re-tier on scope change, incidents and new integrations, not just at renewal.
Frequently asked questions
How many tiers should a vendor risk programme have?
Three or four tiers work for most organisations. Fewer than three makes it hard to separate critical vendors from moderate ones, while more than four creates boundary arguments and inconsistent decisions. What matters most is that each tier triggers a clearly different set of activities, so business owners understand why a vendor was placed where it was.
Is vendor tiering based on inherent or residual risk?
Tiering should be based on inherent risk, meaning the risk created by the relationship before considering the vendor’s controls. The tier then decides how deeply you assess those controls. Residual risk is the result of that assessment, and it can lead to remediation requests, extra contract terms or a recorded risk, but it should not move a critical vendor to a lower tier.
Who should decide a vendor’s tier?
The business owner usually completes the intake questionnaire because they know how the service will be used. The risk or security team owns the scoring rules, reviews borderline cases and approves Tier 1 and Tier 2 classifications. Procurement enforces the process by refusing to issue a contract until a tier has been recorded.
Does DORA require a specific tiering model?
No. DORA does not prescribe a number of tiers. It does require financial entities to identify ICT services that support critical or important functions and apply additional contractual provisions and oversight to them under Articles 28 and 30. In practice, those services should sit in your highest tier or trigger an automatic override.
How often should vendors be re-tiered?
Re-tier whenever the scope of a relationship changes, for example new data types, new integrations or a new business use, and after any significant incident. Otherwise, review the tier at each reassessment cycle, which is commonly annual for critical vendors and every two to three years for moderate ones.
Conclusion: put your effort where the risk is
Third-party risk tiering is the difference between a TPRM programme that scales and one that drowns in questionnaires. Define a handful of impact-based criteria, add overrides for regulated and privileged relationships, attach a clear package of activities to each tier and keep classifications current as relationships change. The result is faster onboarding for low-risk suppliers and deeper, defensible oversight for the vendors regulators care about most.
If you would like to see how tiering, assessments and cross-framework evidence can work together, contact us or book a demo or start your 14-day free trial.
