Turn assessments into clear, actionable vendor plans fast. Compare control areas, weights, and evidence confidence. Download results, share with teams, reduce third‑party risk quickly.
| Domain | Total | Not Applicable | Implemented | Partial | Weight |
|---|---|---|---|---|---|
| Access Control | 22 | 2 | 14 | 4 | 5 |
| Data Protection | 20 | 1 | 12 | 5 | 5 |
| Incident Response | 16 | 1 | 9 | 3 | 4 |
| BC/DR | 14 | 2 | 7 | 3 | 4 |
| Monitoring & Logging | 18 | 3 | 9 | 4 | 4 |
Vendor gaps appear when required safeguards are missing, partial, or untested. In many programs, 40–60% of questionnaire items map to access, data protection, monitoring, and response. This calculator converts those counts into a comparable gap percentage so reviews stay consistent across vendors, tiers, and regions. Teams can set targets, keeping weighted gaps under 20% for Tier 1 services quickly.
Not every control has equal impact. A weight scale of 1–5 lets you elevate high‑impact domains, such as encryption or privileged access. If two vendors both show 30% raw gaps, the one with higher weights in critical domains will surface as a higher weighted gap, guiding remediation sequencing. Many organizations start with weights of 5 for data protection and access control, 4 for incident response and monitoring, and 3 for continuity and compliance.
Implementations are rarely binary. The tool credits partial controls at 50% by default, reflecting “designed but not enforced” states. For example, 12 implemented and 4 partial out of 18 applicable yields effective implementation of 14.0 and coverage of 77.8%, which translates into a 22.2% gap for that domain. If partial controls are closer to “implemented,” you can model that by converting some partial items into implemented counts during re‑assessment.
Risk factors (1–5) translate into an inherent risk score (0–100). Residual risk then scales with the weighted gap and is reduced by compensating controls. With inherent risk 70, weighted gap 35%, and compensating effectiveness 20%, residual risk estimates 19.6. Evidence confidence adds operational context: a 90% confidence score suggests strong testing, while 50% indicates that document review should be supplemented with technical validation or interviews.
Exported CSV and PDF outputs help track remediation over time. Capture assessment date, tier, and evidence confidence to support re‑testing cycles. A practical cadence is 90 days for critical vendors and 180 days for medium‑impact vendors, with targeted retests focused on the top three gap drivers. When gaps remain above policy thresholds, document acceptance rationale, compensating measures, and deadlines in your vendor register to maintain traceability.
It shows the average shortfall across applicable controls after applying domain weights. A lower value indicates stronger overall control coverage in higher‑impact areas.
Start from your risk appetite: use 5 for domains tied to critical data and privileged access, 4 for monitoring and incident response, and 3 for continuity or compliance. Adjust by vendor tier and integration depth.
Partial credit models controls that exist but are not fully enforced, such as MFA for admins only. It prevents overstating maturity while still recognizing progress. Reassess and move items to implemented when evidence improves.
Residual risk scales inherent exposure (0–100) by the weighted gap, then reduces it by compensating control effectiveness. It is a prioritization aid, not a substitute for testing or formal risk acceptance.
Evidence confidence reflects how reliable the control claims are. Higher scores suggest validated testing, logs, or attestations. Lower scores indicate you should request additional artifacts, interviews, or technical verification before closing gaps.
Yes. CSV supports trend analysis and remediation tracking, while PDF is useful for sharing assessment snapshots. Store exports with dates, tier, owners, and retest plans to show governance over third‑party risk.
Important Note: All the Calculators listed in this site are for educational purpose only and we do not guarentee the accuracy of results. Please do consult with other sources as well.