Inputs
How to use
- Enter contractor volume and access details.
- Select the data sensitivity for what contractors touch.
- Set control strength levels based on evidence, not intent.
- Press Calculate Risk to view score and tier.
- Use CSV or PDF export to share results with stakeholders.
Formula used
The calculator converts each input into a 0–1 risk factor, multiplies by a weight, and sums the contributions.
Lift = 1 + 0.25 × (PrivilegedShare × IdentityControlGap)
- normalized_factor scales inputs onto comparable risk ranges.
- Controls are inverted so stronger controls reduce risk.
- Lift increases risk when privilege is high and identity controls are weak.
- Tiers: Low < 25, Moderate < 50, High < 75, Critical ≥ 75.
Example data
| Name | Role | Data | Privileged | Remote | Controls | Risk |
|---|---|---|---|---|---|---|
| Contractor A | DevOps Support | Internal + Client | Yes | High | MFA 4/5, PAM 60% | High |
| Contractor B | Call Center | Personal | No | Medium | MFA 3/5, DLP 3/5 | Moderate |
| Contractor C | Data Analyst | Sensitive | No | Low | MFA 5/5, Monitoring 4/5 | Low |
Use this table to explain typical scenarios to reviewers.
Risk inputs interpreted
This calculator treats contractor exposure as measurable business risk. Contractor count, access scope, remote work share, and external system usage expand opportunity for misuse. Data sensitivity scales impact from public to highly restricted. Vendor maturity and recent incidents reflect third‑party assurance. Human factors include turnover, short contract duration, and training cadence. Enter evidence-based values from inventories, IAM reports, and vendor assessments for consistent comparisons. Include temporary accounts and shared providers.
How the score behaves
Each input is normalized to a 0–1 factor, then weighted and summed. The result is multiplied by a lift when privileged access is high and identity controls are weak. Scores range 0–100, mapping to Low, Moderate, High, and Critical tiers. For example, raising privileged share from 10% to 30% can noticeably increase the lift. Improving PAM coverage or MFA strength reduces that multiplier and the total score. under identical conditions.
Control maturity benchmarks
Control fields use a 1–5 maturity scale to model real safeguards. “1” represents inconsistent or manual practice, while “5” indicates well governed, audited, and automated controls. Strong monitoring and logging reduce time-to-detect contractor anomalies. DLP and encryption reduce data loss likelihood and blast radius. Device management supports posture checks for remote endpoints. Use your latest audit findings, configuration baselines, and alert performance metrics when selecting maturity levels. across environments.
Interpreting tiers and actions
Interpret tiers as prioritization, not prediction. Low suggests routine governance, quarterly sampling, and steady offboarding hygiene. Moderate highlights gaps needing near-term hardening, such as access reviews, device posture enforcement, and targeted detections. High indicates meaningful exposure; focus on privileged workflows, segregation of duties, and expanded telemetry. Critical calls for immediate access reduction, supervised privileged sessions, and remediation validation before restoring broad permissions. Export reports to drive accountable action plans. with deadlines.
Using results in governance
Use scenario analysis to support vendor onboarding and contract renewals. Compare a “current state” baseline to a “planned controls” scenario to quantify expected risk reduction. Track trends monthly by updating key fields like incidents, privileged share, and review cadence. Align actions with policy: require MFA and PAM for sensitive systems, enforce rapid deprovisioning on termination, and document exceptions. The example table illustrates how different roles and controls shift outcomes. for governance reviews.
FAQs
What does the score represent?
It is a normalized 0–100 indicator of contractor insider risk based on exposure, impact, and control strength. Higher scores mean more opportunity and weaker safeguards, not confirmed wrongdoing.
How should I pick 1–5 control levels?
Use evidence: policy enforcement, configuration coverage, audit results, alert quality, and automation. If practices vary by team, choose the weakest material level or calculate separate scenarios.
Why does privileged access change results more?
Privileged actions can bypass normal controls and affect production, financial, or identity systems. The model adds a lift when privilege is high and identity controls are weak, reflecting higher systemic impact.
How often should I recalculate?
Update monthly or after meaningful changes: new vendors, role changes, incidents, tooling upgrades, or contract renewals. Recalculating supports trend tracking and validates that mitigations actually reduce risk.
Can I compare different vendors or teams?
Yes. Keep the same scoring approach and inputs, then run separate scenarios per vendor or contractor group. Use consistent data sources so differences reflect real posture, not estimation bias.
What is included in the exports?
The CSV contains your inputs plus the resulting score, tier, and top drivers. The PDF summarizes the score, tier, lift multiplier, drivers, and recommendations for quick sharing with reviewers.