What is a cybersecurity risk assessment?

A cybersecurity risk assessment is a structured evaluation of your organization's security environment. It identifies vulnerabilities, threats, and risks, then provides clear recommendations to close the gaps. Our assessments are aligned to frameworks like NIST CSF 2.0.

What does a vCISO do?

A virtual CISO (vCISO) provides executive-level cybersecurity leadership without requiring a full-time hire. This includes security strategy, executive-ready reporting, risk oversight, vendor evaluation, and program development — tailored to your organization's size and maturity.

How is Seven Vector different from an MSSP?

MSSPs focus on security operations and tooling. Seven Vector runs the security program — assessment against the framework, readiness, risk and remediation planning, policy and documentation, evidence organization, and executive reporting. Client teams and providers retain responsibility for technical operations and system changes.

What compliance frameworks do you support?

We support readiness across federal, regulated-industry, enterprise, and privacy frameworks. Each engagement is scoped to the client’s applicable requirements.

What industries do you serve?

We work with organizations across defense contracting, healthcare, technology, financial services, and critical infrastructure — any organization that requires structured cybersecurity consulting and clear security direction.

How to Build a Third Party Risk Management Program with NIST SP 800-53

Build a practical third-party risk program with clear intake rules, supplier tiers, evidence-based reviews, and documented risk decisions.

Here is how to build a third party risk management program: establish supplier intake, assign risk tiers, review evidence, record approval decisions, and monitor changes. Use NIST SP 800-53 Rev. 5 to organize the requirements, then give procurement, security, legal, and business owners clear tasks at each step.

Start with the requirements in NIST SP 800-53

NIST SP 800-53 Rev. 5 provides controls relevant to third-party risk, especially in the Supply Chain Risk Management and System and Services Acquisition families. Three controls give you a useful starting point:

SR-2, Supply Chain Risk Management Plan: develop a plan for managing supply chain risks associated with systems, components, and services. Review and update it at an organization-defined frequency or as changes require.
SR-6, Supplier Assessments and Reviews: assess and review supply chain risks associated with suppliers or contractors and the systems, components, or services they provide at an organization-defined frequency.
SA-9, External System Services: establish applicable security and privacy requirements for external service providers, define oversight and user responsibilities, and monitor provider compliance on an ongoing basis.

These controls do not prescribe a universal questionnaire, tier count, or annual review schedule. Determine which requirements apply through your selected controls, contracts, and legal obligations. Document your review methods in the supply chain risk management plan. Supplier records, assessment reports, and monitoring records then show how you carry out that plan.

How do you start a third-party risk management program?

Start with an inventory and one intake route. Procurement should reconcile purchasing and contract records with business-owner input. Security should compare that inventory with external connections and supplier accounts. This finds providers that entered through individual departments or older agreements.

Define the scope in writing. Include suppliers that handle sensitive information, access your systems, support critical operations, or supply components covered by your requirements. Track the service being purchased, not just the supplier name. One supplier may provide several services with different risks.

The business owner submits intake before contract signature, data transfer, or access approval. Ask for facts the owner can reasonably know:

Supplier, service description, business owner, and procurement contact.
Data types involved, where data will be stored or processed, and expected transfers.
Required access, including privileged accounts, remote connections, and physical access.
Business processes supported and the effect of an outage or supplier failure.
Known subcontractors, contract dates, and applicable customer or regulatory requirements.

Procurement checks completeness. Security reviews exposure. Legal identifies contract requirements. The business owner explains operational dependence. Record unknowns as open questions rather than treating missing information as low risk.

How should you tier suppliers in a third-party risk program?

Assign an initial tier using inherent risk: the exposure created by the proposed service before considering the supplier’s controls. Keep this separate from residual risk, which reflects the controls and evidence reviewed later.

A practical three-tier model could use these rules:

High: privileged access, sensitive data at significant scale, or a service failure that would interrupt a critical operation without a practical alternative.
Moderate: limited confidential information or system access, with a manageable interruption and an available replacement.
Low: public information only, no system access, and little operational dependence.

Define sensitive data and critical operations for your organization. Establish escalation rules so one severe exposure cannot disappear inside an average score. A supplier with privileged access should receive close review even if its contract value is small.

Security proposes the tier. The business owner validates the operational impact. Record the rationale, unresolved assumptions, and reviewer. Use the tier to set review depth, approval authority, and review frequency. Strong evidence may reduce residual risk without changing the service’s inherent tier.

What should a third-party risk questionnaire ask?

Build a short core questionnaire, then add questions triggered by data, access, and operational dependence. Ask about the specific service under review. Answers about the supplier’s corporate office may say little about the service handling your information.

Each material question should identify the requirement, request evidence, and support a decision. Useful examples include:

Access: How are privileged accounts approved, reviewed, and removed? Request the access procedure and a redacted review record.
Data handling: Where does your information travel, who can access it, and how is it deleted? Request a service data-flow description and relevant retention terms.
Vulnerability management: How are weaknesses identified, prioritized, and corrected? Request the procedure and a redacted remediation report showing overdue items.
Incident response: Who notifies you, what events trigger notice, and what information follows? Review the response plan and proposed contract language.
Recovery: What service recovery commitments apply, and when were they tested? Request the relevant test summary and unresolved findings.
Subcontractors: Which organizations handle your data or support critical service functions? Request their roles and the process for notifying you of changes.

Security should check whether evidence is current, covers the purchased service, and supports the answer. A policy states intent; a completed access review or recovery test shows execution. Record contradictions and request clarification.

If a supplier provides a SOC 2 report, inspect its scope, reporting period, exceptions, subservice organization treatment, and complementary user entity controls. Assign relevant customer-side tasks to your own owners. A report should inform your review rather than automatically close every question.

Record findings and make an explicit approval decision

Security records each material gap with the affected requirement, supporting evidence, likely impact, and proposed treatment. Keep the gap list separate from the final approval decision so business urgency cannot erase an unresolved issue.

Choose a treatment for each finding: require correction, restrict access or data, add an internal control, accept the remaining risk, or select another supplier. Give corrective actions an owner, a target date, and closure evidence. A promise to fix an issue is an open action.

Legal translates agreed requirements into contract terms where appropriate, including incident notice, subcontractor changes, evidence access, and data return or deletion. Procurement confirms that required approvals are recorded before purchase. Access administrators check approval before enabling connections.

Your policy should name the official who can accept residual risk at each level. For conditional approval, record the permitted use, restrictions, unresolved gaps, acceptance rationale, and expiration or reassessment trigger in the risk register.

How do you keep a third-party risk program current?

Set scheduled reviews and event-driven reviews. SR-6 leaves the assessment frequency to the organization. For example, you might reassess high-tier suppliers annually and check their open findings more often. Document why the frequency fits the exposure and any applicable contract requirements.

Trigger an earlier review when a supplier reports an incident, adds a significant subcontractor, changes data locations, expands access, or takes on a new critical service. Renewal should prompt a scope check, not just a reminder to collect the same questionnaire.

The business owner confirms continued need and service changes. Security reviews new evidence, incidents, and unresolved findings. Procurement tracks renewal dates and missing responses. Legal reviews material changes to terms. Keep the resulting decision and next review date in the supplier record.

Include termination in the process. The business owner confirms service shutdown; access administrators remove accounts and connections; the data owner verifies return, retention, or deletion against the contract. Retain closure evidence according to your records requirements.

Check whether the process works

Pilot the process with a high-risk supplier, a moderate-risk supplier, and a low-risk supplier. Check whether intake captures the facts needed for tiering and whether reviewers can explain their decisions. Remove questions that never affect a requirement or risk decision.

Track suppliers without owners, overdue reviews, overdue corrective actions, expired risk acceptances, and services started before approval. Review those exceptions with the people authorized to resolve them. Questionnaire completion counts alone can hide serious gaps.

How Seven Vector helps

We use Assess, then Build, then Operate. We assess your supplier inventory and review practices, build intake and tiering rules around your requirements, and support evidence reviews and ongoing risk tracking. We help your teams make clear decisions and follow through on remediation. Call Seven Vector for a confidential initial consultation.

Questions

Does NIST SP 800-53 require every supplier to complete a questionnaire?

It does not prescribe a universal supplier questionnaire. SR-6 calls for supplier risk assessments and reviews at an organization-defined frequency. Choose review methods that address your applicable requirements and the supplier’s risk.

Can a SOC 2 report replace a supplier questionnaire?

It can answer relevant questions and reduce duplicate requests. Check service coverage, dates, exceptions, and customer-side controls first. Ask targeted follow-up questions for requirements the report leaves unresolved.

Who should own third-party risk management?

Name one program owner to maintain the process and records. Procurement manages intake, security evaluates evidence, legal handles contract terms, and business owners explain operational impact. Designated officials approve residual risk.

What if a supplier will not share detailed security evidence?

Ask for redacted records, a restricted review, or a relevant independent report. Record remaining uncertainty. Then decide whether access restrictions, reduced data sharing, explicit risk acceptance, or a different supplier best addresses the exposure.

Call (888) 753-6725. Calls answered 24/7, 365 days a year.