Use this once to set up supplier risk management, then whenever a supplier is onboarded or its use changes. You get three files in a new folder, ./vendor-tiering/: a spreadsheet you can open in Excel listing every supplier with its scores, tier and next review (vendor-tiers.csv), a one-page note on how the tiers are decided, short enough for an owner to apply alone (tiering-method.md), and the questions each business owner must answer to confirm their suppliers' scores (questions-for-owners.md). This skill drafts for a human to review and sign; this skill never marks a control effective. The tier is a proposal; the business owner of each supplier confirms it.

Inputs to gather

Read the supplier list if one exists, the accounts payable export for the last twelve months, the single sign-on application list, the contract repository, the list of signed data processing agreements, the architecture overview and the business impact analysis if there is one. Ask the reader, in one message: which three services the company could not run without for a week, which teams buy software on cards or expenses, and whether any regulation in scope treats some suppliers specially (for example, services supporting critical functions of a financial entity).

Step 1: build the full population

Merge the sources and deduplicate by legal entity, not by product name. The supplier list alone is never complete. Add what finance pays, what single sign-on shows, what engineers call from code (hosting, email delivery, error tracking, analytics, AI models), contractors and agencies with access, and free tools where staff upload company or customer data; no spend does not mean no risk. Mark each row with where it was found.

Step 2: score three axes

Score each supplier on a three-level scale per axis and write one line of reasoning per score:

Data: none or public (1); internal or limited personal data (2); customer data, confidential data, regulated data or personal data at scale (3).
Access: none, or access only to the supplier's own service (1); user-level access into company systems or networks (2); privileged access, access to production, source code or the ability to change what customers receive (3).
Dependency: replaceable within a week (1); replaceable within a month, or a key process degrades (2); critical, no fast alternative, outage stops revenue or a regulated service (3).

Add flags that do not change the score but drive extra work: processes personal data on the company's behalf, supports a function a regulation treats as critical, located or accessed outside the company's jurisdiction, and handles personal data or has privileged access with no signed agreement covering security and processing terms (an immediate action for the owner).