Assessment inputs
Example data table
| Vendor | Function | Criticality | Dependency | Recovery | Risk Score | Tier |
|---|---|---|---|---|---|---|
| NorthBridge Cloud | Hosting | 5/5 | 92% | 18h vs 8h | 71.40 | High |
| SignalForge IAM | Identity | 4/5 | 70% | 5h vs 6h | 33.10 | Guarded |
| Mercury Support Hub | Service Desk | 3/5 | 35% | 4h vs 8h | 18.90 | Low |
Formula used
Continuity Risk Score = Σ (normalized factor risk × factor weight).
Each factor is converted to a 0 to 100 risk value. Positive controls such as recovery evidence, testing frequency, and exit readiness reduce risk through inverse scoring.
RTO gap risk = max(0, ((estimated recovery − target RTO) ÷ target RTO) × 100), capped at 100.
Resilience Score = 100 − Continuity Risk Score.
This model emphasizes dependency concentration, business criticality, recovery realism, and supplier durability because those factors usually amplify operational and cybersecurity disruption impact.
How to use this calculator
- Enter the vendor name, assessment date, and the business function supported.
- Rate dependency, criticality, geographic concentration, financial concern, and exit readiness using your current vendor review evidence.
- Add recovery evidence confidence, disaster recovery testing frequency, target RTO, and expected recovery time from contractual or audit records.
- Capture recent incidents, SLA failure rate, and subcontractor reliance to reflect current operating conditions.
- Submit the form to view the score, risk tier, top contributors, and export-ready summary.
Frequently asked questions
1. What does this calculator measure?
It estimates how likely a vendor could create business disruption during outages, recovery failures, supplier instability, or concentration events, then converts that exposure into a weighted score.
2. Why is business criticality weighted heavily?
A minor disruption becomes far more damaging when the supplier supports essential services such as hosting, identity, payments, or incident response. Higher criticality increases consequence severity.
3. How should I rate recovery evidence confidence?
Use higher percentages when you have recent audit reports, tested continuity plans, verified recovery metrics, and independent assurance. Use lower percentages when claims are untested or outdated.
4. What is a good continuity risk score?
Lower scores are better. Low usually indicates manageable exposure, Guarded suggests monitoring, High often needs remediation, and Severe requires urgent continuity planning and management attention.
5. Why include financial health risk?
Vendor distress can reduce staffing, delay recovery investment, increase service failures, or trigger unexpected provider changes. Financial weakness often signals wider continuity fragility.
6. What does exit readiness mean?
It measures how prepared your organization is to move workloads, data, or processes away from the vendor. Strong exit readiness reduces lock-in and lowers continuity exposure.
7. Can this calculator replace a full vendor review?
No. It supports triage and prioritization. Formal vendor risk management should still include due diligence, control reviews, legal terms, audit evidence, and business impact analysis.
8. How often should I reassess the same vendor?
Reassess at least annually and whenever service scope changes, incidents occur, mergers happen, subcontractors change, or contract renewals introduce new recovery obligations.