Supplier Risk Index Calculator

Each dimension is scored from 0 to 5, where higher means safer. Convert the score to a safety percentage: Safety% = (Score ÷ 5) × 100.

The Supplier Safety Index is the weighted sum of all safety percentages: Index = Σ(Safety% × Weight%), with weights totaling 100.

The Risk Score is the inverse of the index: Risk = 100 − Index. Levels: Low (<35), Moderate (35–54.99), High (55–74.99), Critical (≥75).

1. Enter supplier details and confirm the assessment date.
2. Score each dimension from 0 to 5 using available evidence.
3. Adjust weights to reflect what matters most to your environment.
4. Ensure the weight total equals 100, then submit.
5. Review the index, risk level, top drivers, and actions.
6. Export CSV/PDF to share, store, or attach to reviews.

Supplier attack surface and business impact

Third parties extend your environment through integrations, support channels, remote administration, and shared data stores. A single weak supplier can enable credential theft, ransomware staging, phishing amplification, or unauthorized data extraction. Quantifying exposure helps procurement and security compare vendors consistently, prioritize reviews, and justify mitigations based on measurable risk. It also supports board reporting by translating technical findings into a repeatable score.

Structured scoring for evidence-based decisions

This calculator uses ten dimensions covering controls maturity, assurance, incidents, access, data sensitivity, geography, financial stability, criticality, subprocessors, and visibility. Each is scored from 0 to 5 using verifiable evidence such as audit reports, incident disclosures, penetration testing summaries, architecture diagrams, and monitoring coverage. Capture the date of evidence and whether exceptions exist, because stale proof and unbounded exceptions reduce confidence even when controls look strong.

Weighted index aligned to your priorities

Not every supplier poses the same threat. A payroll processor may warrant heavier data sensitivity weighting, while an infrastructure provider may demand higher access and monitoring emphasis. By requiring weights to total 100, the model maintains comparability while letting you reflect what matters most in your operating context. When scope expands, revisit weights instead of inflating scores, so the index remains defensible across renewal cycles.

Interpreting results and thresholds

The Safety Index aggregates weighted safety percentages, then converts to an inverse Risk Score. Lower risk suggests routine monitoring, while higher risk signals tighter access, contract clauses, and remediation deadlines. Use consistent thresholds across departments, document rationale for exceptions, and reassess after major scope changes or new incidents. Pair the score with qualitative notes, such as data residency constraints or incident response maturity, to avoid oversimplification.

Operationalizing supplier risk management

Use outputs to drive action: tailor onboarding controls, segment network pathways, enforce least privilege, and require timely patching. Track top risk drivers to focus remediation on the largest contributors rather than chasing minor gaps. Export reports for audit trails, renewals, and executive dashboards, and schedule periodic reassessments to ensure controls remain effective. Over time, trend the index to measure whether supplier improvements actually reduce your residual risk. Include exit plans for critical suppliers before contracting.