Scrutineer · Vendor risk

Vendor security assessment software: a platform that returns a scored verdict

A vendor security assessment is supposed to answer one question: is this vendor safe enough to trust with our data and systems? Too often it produces a 200-row questionnaire that no one fully reads and a yes that nobody can defend. Scrutineer turns the assessment into a scored, evidence-backed verdict you can actually stand behind.

Scrutineer evaluates the vendor security posture against a clear standard, weighs their certifications and the sensitivity of the data they touch, and returns a risk score with the evidence behind each factor. You see exactly where a vendor is strong, where it is weak and what would need to change to approve it. The decision stays yours; the assessment gives you the proof to make it well.

or try it below ↓

Control-mapped findings · linked evidence · you decide what to remediate

The Scrutiny Desk

Illustrative sample · not an audit attestation

SOC 2 ISO 27001 HIPAA GDPR PCI DSS

Controls in evidence-linked report out

AI scrutinizes you decide

Why it works

What you get with security assessment

Posture against a standard

Scrutineer assesses each vendor security posture against a clear, consistent standard, so a strong-looking vendor and a weak one are measured the same way.

A scored, evidence-backed verdict

The assessment returns a risk score with evidence behind every factor, so approval rests on proof rather than a questionnaire skim.

Clear remediation path

You see exactly which weaknesses pushed the score down and what would need to change, so a borderline vendor has a concrete path to approval.

What it handles

Controls in, an evidence-linked report out

Point Scrutineer at a framework or a vendor and it maps every control, pulls the evidence it can find, flags the gaps and scores the risk, returning a report with linked evidence and a prioritized remediation list. Scrutineer is decision support for readiness, an accredited auditor still issues the attestation.

Assesses vendor security posture against a standard
Weighs certifications and data sensitivity
Returns an evidence-backed risk score
Shows where a vendor is strong and weak
Spells out what would change the verdict
Keeps a defensible record of the assessment

SECURITY ASSESSMENT readiness_report

READINESS · 82%

ACCESS CONTROL 91

evidence · MFA enforced and access reviews evidenced.

CHANGE MGMT 78

evidence · Mostly covered; one approval log left untested.

VENDOR RISK 64

evidence · Two subprocessors missing a current review.

ENCRYPTION 86

evidence · Data encrypted in transit and at rest, evidenced.

Example report layout, not customer data

Why Scrutineer

One platform that maps controls and scores risk

Not a static questionnaire, not a pass-fail black box, and not a spreadsheet you maintain by hand. Live control mapping across SOC 2, ISO 27001, HIPAA, GDPR and PCI, automatic evidence and a prioritized gap list, returned as a report you can act on. The AI scrutinizes, you decide.

Mapped to real controls

Every framework is broken down into the controls it actually requires, each scored on a red to amber to green scale, so readiness stays transparent and consistent.

Evidence behind every finding

Each control links to the exact evidence that satisfies it, the policy, the config, the log line, so the finding is auditable and your readiness is defensible.

A prioritized gap list

Open gaps roll up into a ranked remediation list, so the highest-risk findings sit at the top and your team fixes what matters before the audit begins.

Assessment depth reference

What to collect at each vendor risk tier

Depth of diligence should follow the damage a vendor could do, not the size of the invoice. This is the reference model most US programs settle on.

Risk tier	Who lands here	What the assessment collects	Reassessment
Tier 1: critical	Holds regulated data such as PHI or cardholder data, has privileged production access, or an outage stops revenue.	Full assessment, SOC 2 Type 2 or ISO 27001 certificate read for scope and exceptions, pen test summary, BC and DR evidence, subprocessor list, negotiated security terms.	Continuous monitoring plus a formal annual reassessment, and immediately on breach, acquisition or material change.
Tier 2: important	Internal or limited customer data, no privileged access, a workaround exists but it is painful.	Standard questionnaire, attestation or certificate checked for scope and expiry, DPA where personal data is involved.	Breach and posture monitoring, scheduled review every 12 to 24 months or on trigger.
Tier 3: low risk	No sensitive data, no system access, easily replaced. The long tail of small SaaS and services.	Short screening set whose only job is to confirm the no-data, no-access assumption is actually true.	Inventory review annually, reassess only if the relationship changes.
Any tier, on trigger	A disclosed breach, a change of control, a lapsed or rescoped certificate, or a new data flow or access grant.	Re-run the diligence the new tier requires, not the tier the vendor was originally given.	Pulls the next review forward regardless of the schedule.

Tier boundaries are a policy choice, not a standard. What an auditor tests is whether you applied your own criteria consistently and kept the records.

Good questions

Questions about security assessment

It makes the questionnaire useful. Scrutineer can collect and evaluate vendor responses, weigh them against evidence and certifications, and turn the result into a scored verdict, so you get a defensible answer instead of a stack of unread answers.

The risk score shows exactly which factors pulled it down, each backed by evidence. That gives you a clear, defensible basis to reject, or a concrete list of what the vendor would need to fix to be approved.

A vendor security assessment is a structured review of how well a third party protects the data and systems you would be trusting them with. It looks at their controls, certifications, past incidents and the sensitivity of what they handle, then produces a documented verdict on whether the risk is acceptable. It is the evidence behind a vendor approval decision, not a formality.

Start by classifying the vendor by the data and access it needs, since that sets the depth of review. Collect evidence, meaning certifications, audit reports, policies and questionnaire responses. Measure what you receive against a consistent standard rather than judging each vendor on instinct. Score the result, record which factors drove it, and set the reassessment date before you approve.

At minimum: the data types and systems the vendor touches, their access model, their certifications and audit reports, how they handle encryption, access control, logging and incident response, their own subprocessors, and their breach notification commitments. The assessment should end with a score, the evidence behind it, and a named owner for anything left open.

Tie the cadence to risk tier rather than to the calendar alone. Critical vendors holding sensitive data are commonly reviewed annually, with continuous monitoring in between so a lapsed certification or a new incident surfaces immediately. Lower-risk vendors can sit on a longer cycle. Any material change, a breach, an acquisition or a new data flow, should trigger a reassessment regardless of the schedule.

Read every compliance and risk question

Keep reading

Guides that go deeper on vendor risk

Vendor tiering: criteria and a 3-tier model

The five criteria that set a vendor tier, a three-tier model to copy, review cadence and the mistakes that break tiering.

Read the guide

The vendor risk management process

Intake and tiering, due diligence, scoring third-party risk, continuous monitoring and remediation, step by step.

Read the guide

Automating security questionnaires

How SIG, CAIQ and bespoke questionnaires get answered from an evidence-backed control library instead of from scratch.

Read the guide

Running a cybersecurity risk assessment

The NIST SP 800-30 method in eight steps: scope, assets, threats, likelihood and impact scoring, then treatment.

Read the guide

Explore more

More ways to scrutinize compliance and risk with Scrutineer

SOC 2 compliance

Map controls to the Trust Services Criteria, collect evidence, and close gaps before audit.

Learn more

SOC 2 compliance software

A platform that maps SOC 2 controls, automates evidence, and tracks readiness continuously.

Learn more

ISO 27001 compliance

Map your ISMS to Annex A, automate evidence, and stay certification-ready.

Learn more

See every use case See pricing Back to Scrutineer

Stop guessing about readiness. Scrutinize on real evidence.

Point Scrutineer at a framework or a vendor and it maps every control, gathers evidence and scores the risk, returning an evidence-linked report and a prioritized gap list. The AI scrutinizes, you decide.

See pricing

SOC 2, ISO 27001, HIPAA, GDPR & PCI · evidence-linked controls · readiness, not certification