Skip to main content
For AI agents: a documentation index is available at https://docs.coverbase.com/llms.txt. This page is also available in markdown by appending .md to the URL.
This guide is part of the User Guides collection. Read it when you are choosing which packaged inherent risk questionnaire to start from, or when you want to see exactly what a template asks before you send it.
An inherent risk questionnaire (IRQ) rates a third party before any of their controls are taken into account. Its score decides how much due diligence the relationship earns and how often it comes back for reassessment, so it is short: the longest template here is fifteen questions and most are ten to twelve, and the shortest takes about a minute. The IRQ library gives you twenty-one of them ready to use, grouped into cybersecurity, compliance, financial, operations, legal, reputational and sector templates. Open it from the IRQ Library button at the top right of Configuration → Questionnaires → Inherent Risk, browse by category, and copy the one you want.
Copying a template produces an ordinary questionnaire you own and can edit: question wording, options, weights, reviewers, everything. Nothing syncs back: later changes to the Coverbase template do not reach your copy, and your edits never leave your workspace.

​
What ships

​
Choosing a starting point

Pick by what the engagement does to your risk, not by the industry you are in. A hospital buying a marketing analytics tool wants the Data Privacy set, not the Healthcare one, unless that tool will touch patient records.

Start with Standard

It covers data, access, criticality, spend, geography and subcontracting without assuming anything about your sector.

Add Quick Triage alongside it

Point self-service intake at Quick Triage and reserve the longer templates for the vendors triage flags. Most requests never need fifteen questions.

Use a sector template when a regulator is watching

Financial Services and Healthcare exist because examiners expect specific determinations (critical activity, business associate status) that a generic questionnaire never asks for.

Run AI & Emerging Tech as a second pass

It answers a different question from the others: not how much of your data is exposed, but what the system decides on its own. Pair it with whichever template fits the underlying purchase.

Use a regime template when a contract flows one down

CMMC & CUI, NIS 2, DORA and Payment & Cardholder Data each lead with the one determination that regime turns on, such as whether CUI flows or whether the service supports a critical or important function.

Match the template to what the vendor does

Cloud, software, managed service, contractor, manufacturing and marketing vendors carry different exposures. Pick the template for the engagement type, then add a sector template if a regulator expects one.

​
Every template in detail

The industry-agnostic default. It covers data sensitivity and volume, network access, business criticality, customer contact, contract spend, regulatory exposure, offshoring, subcontracting and replaceability.Engagement Overview (no risk domain; context only, unscored)
  1. Describe the product or service the third party will provide. (free text)
  2. Who is the internal relationship or business owner for this engagement? (contacts)
Data Access and Sensitivity (Cybersecurity)
  1. Will the third party access, store, transmit or process any of our data?
  2. What is the most sensitive classification of data involved? Options: Public or de-identified · Private · Confidential · Restricted
  3. How many records will the third party access, store, transmit or process in aggregate? Options: five bands from under 1,000 to 500,000 or more
  4. Will the third party have access to our networks or internal systems? Options: via their own equipment · via company equipment or VDI · no
  5. Is this a hosted or cloud-delivered solution?
Business Impact (no risk domain)
  1. How critical is this product or service to the business? Options: High, unrecoverable process · Medium, recoverable with minor impact · Low
  2. Does the third party have direct or indirect contact with our customers?
  3. Does the third party support our critical infrastructure (software, hardware, data center or network connectivity)?
  4. How long would it take to replace this third party if needed? Options: over 12 months · 6-12 months · under 6 months
  5. What is the expected spend over the life of the contract? Options: six bands from under US$5,000 to over US$1,000,000
Regulatory and Geographic Exposure (Compliance)
  1. Does this relationship present a regulatory risk? Options: Yes · Unknown · No
  2. Is any aspect of this product or service, including subcontracted work, performed offshore? Options: offshore with offshore data · offshore with onshore data · no
  3. Does the third party rely on a material subcontractor for any part of the product or service?
Heaviest weights: offshore processing and contract spend, each up to 20 points. No score floors. The answers alone set the score.Typical use: New vendor intake triage; determining due diligence depth; setting reassessment cadence; annual re-tiering.
Written for a requester who is not a risk professional, so a software purchase request can be routed in under a minute. Six questions, one section, no free text.
  1. What is the most sensitive data this vendor will handle? Options: Regulated or restricted (health, financial, government ID) · Confidential business or customer records · Internal only · Public only · None
  2. Will the vendor connect to our systems, networks or accounts? Options: privileged/admin/write · read-only or limited integration · no
  3. If this vendor went down for a week, what would happen? Options: could not serve customers · a team significantly degraded · little or no impact
  4. What is the expected annual spend? Options: over US$250,000 · US$25,000-250,000 · under US$25,000
  5. Does the engagement fall under a regulation such as GDPR, HIPAA, PCI DSS, GLBA or SOX? Options: Yes · Unknown · No
  6. Will the vendor interact with our customers or process customer data? Options: directly · indirectly · no
No score floors. Every question is weighted evenly enough that no single answer dominates, which is what you want from a form a requester fills in about themselves.Typical use: Self-service vendor intake; fast-track approval for low-risk vendors; pre-screening before a full questionnaire.
Built around the pivotal determination in the 2023 Interagency Guidance on Third-Party Relationships: whether the relationship supports a critical activity.Criticality and Regulatory Designation (Compliance)
  1. Does this relationship support a critical activity, meaning one that could cause significant risk if the third party fails to perform, significant customer impact, or significant impact on operations? Yes floors the score at 70.
  2. Which regulatory regimes apply to this engagement? (select multiple) Options: GLBA / Regulation P · BSA / AML / OFAC · SOX · PCI DSS · SEC / FINRA · state money transmission licensing
  3. Will the third party’s outputs feed regulatory reporting or the financial statements?
Consumer Data and Funds (Financial)
  1. Will the third party access, store or process nonpublic personal information (NPI) under GLBA? Options: over 100,000 consumers · under 100,000 · no
  2. Will the third party hold, move or have authority over customer funds? Options: with discretion · pass-through only · no
  3. Will the third party perform a consumer-facing activity subject to UDAAP or fair lending oversight?
  4. Does the third party perform or support BSA/AML, sanctions screening or KYC obligations? Options: performs on our behalf · supporting data or tooling · no
  5. Does the third party have access to core banking, payment, trading or ledger systems? Options: transactional/write · read-only · no
Resilience and Concentration (no risk domain)
  1. What is the maximum tolerable downtime for this service? Options: under 4 hours · 4-24 hours · 1-3 days · over 3 days
  2. Does the third party rely on material subcontractors (fourth parties) to deliver the service? Options: yes, unidentified · yes, disclosed · no
  3. How readily could this third party be replaced?
  4. Where will our data be stored or processed relative to our primary regulator’s jurisdiction?
  5. What is the expected spend over the life of the contract?
Because the critical-activity answer sets a floor, a critical relationship cannot be diluted into a low rating by benign answers elsewhere, which is the failure mode an examiner looks for.Typical use: Bank and credit union vendor onboarding; critical activity designation; examiner-ready tiering; fintech partner due diligence.
Leads with business associate status under HIPAA, then works outward through data, clinical proximity and supply chain.Protected Health Information (Compliance)
  1. Will the third party create, receive, maintain or transmit protected health information on our behalf, making it a business associate? Yes floors the score at 60.
  2. How many patient or member records will the third party handle? Options: five bands from none to 100,000 or more
  3. Which categories of sensitive data are involved? (select multiple) Options: PHI · substance use disorder records (42 CFR Part 2) · behavioral or mental health · genetic or genomic · payment card or billing · de-identified only
  4. Will PHI be stored or processed outside the country of collection?
Clinical and Patient Safety Impact (no risk domain)
  1. Does the service touch clinical care delivery or patient safety? Options: informs diagnosis or treatment · supports clinical workflow · administrative only
  2. Is the product a regulated medical device or software as a medical device (SaMD)? Options: FDA-regulated or CE-marked · under evaluation · no
  3. Will the third party have access to EHR or EMR systems? Options: write or integration · read-only · no
  4. Will the third party interact directly with patients or research subjects?
  5. What is the maximum tolerable downtime for this service?
Regulatory and Supply Chain (Compliance)
  1. Which regulatory regimes apply to this engagement? (select multiple) Options: HIPAA / HITECH · 42 CFR Part 2 · FDA 21 CFR Part 11 · GxP (GCP, GLP, GMP) · state health privacy laws
  2. Does the third party subcontract any part of the service? Options: subcontractors handle PHI · subcontractors without PHI access · no
  3. How long would it take to replace this third party if needed?
  4. What is the expected spend over the life of the contract?
Typical use: Business associate triage; digital health vendor onboarding; clinical system procurement; life sciences supplier qualification.
For any vendor whose product embeds AI, whether or not AI is what you are buying. Aligned with the NIST AI Risk Management Framework and the EU AI Act.AI Footprint (Cybersecurity)
  1. What role does AI play in the product or service? Options: core · optional or embedded feature · none
  2. Will our data be used to train, fine-tune or otherwise improve the vendor’s models? Options: across their customer base · unknown · within our tenant only · contractually prohibited
  3. What is the most sensitive data that will be sent to the model?
  4. Does the vendor disclose which foundation models and AI subprocessors it relies on? Options: not disclosed · partially · fully disclosed and contractually committed
Autonomy and Consequence (no risk domain)
  1. What degree of autonomy does the system have? Options: consequential actions without human review · actions subject to approval · recommends only · informational output only
  2. Will the system have access to our systems, tools or credentials, for example through agentic tool use or an API integration? Options: write or transactional · read-only · no
  3. Does the system make or materially inform decisions about people, such as hiring, credit, insurance, healthcare, housing or education? Yes floors the score at 65.
  4. Is AI-generated output shown to customers or the public? Options: without human review · with review · internal only
Governance and Regulatory Exposure (Compliance)
  1. Under the EU AI Act, how would this system most likely be classified? Options: prohibited or unclear · high-risk (Annex III) · limited risk with transparency obligations · minimal risk or out of scope
  2. Does the vendor maintain an AI governance program, such as documented evaluations, model cards, red-teaming or ISO/IEC 42001 certification?
  3. Could the system’s output create intellectual property, defamation or copyright exposure?
  4. How critical is this AI system to the business?
Question 2 is the one that most often changes a purchase. “Unknown” is weighted almost as heavily as “yes, across the vendor’s customer base” on purpose: an unanswered training question is a live exposure, not a neutral one.
Typical use: AI vendor onboarding; shadow AI discovery triage; EU AI Act readiness screening; agentic tooling review.
Enough to decide whether a DPIA and a transfer mechanism are needed before the engagement proceeds. Aligned with the GDPR and the major US state regimes.Processing Role and Data (Compliance)
  1. What role will the third party play in processing personal data? Options: joint controller · independent controller · processor on our instructions · no personal data
  2. Which categories of personal data are involved? (select multiple) Options: contact details and identifiers · financial or payment · location or behavioral tracking · biometric · special category (health, race, religion, union membership, sexual orientation) · children’s data
  3. How many data subjects are affected? Options: five bands from under 1,000 to over 1,000,000
  4. Which privacy regimes apply to this engagement? (select multiple) Options: EU GDPR · UK GDPR · CCPA / CPRA · other US state privacy laws · LGPD, PIPEDA, APPI or similar
Transfers and Secondary Use (Compliance)
  1. Will personal data be transferred outside its jurisdiction of collection? Options: no adequacy decision or safeguards · adequacy, SCCs or DPF cover · no transfer
  2. Will the third party use personal data for its own purposes, such as analytics, marketing or model training? Options: yes · aggregated or de-identified only · limited to our instructions
  3. Will the third party carry out automated decision-making or profiling? Options: with legal or similarly significant effects · profiling without significant effects · no
  4. Does the third party engage sub-processors? Options: undisclosed · disclosed with a right to object · no
  5. How long will the third party retain personal data? Options: indefinitely or at their discretion · a defined period over three years · no longer than the contract term
  6. Does the engagement involve direct marketing, cookies or cross-site tracking on our behalf?
Typical use: DPIA screening; sub-processor approval; international transfer review; marketing and adtech vendor triage.
Inherent risk triage for SaaS applications, platform and infrastructure providers and hosting services. Covers the data placed in the service, identity and integration reach into our environment, the service model and tenancy, hosting location, availability dependence and the provider’s own subprocessors. Derived from CSA Cloud Controls Matrix (CCM) v4.Data in the Service (Cybersecurity)
  1. What is the most sensitive data that will be stored in or processed by the service? Options: Regulated data (health, payment card, government ID, financial account) · Confidential business or customer data · Internal data only · Public data only · No data is stored
  2. How many individuals’ records will the service hold? Options: 1,000,000 or more · 100,000 - 999,999 · 1,000 - 99,999 · Fewer than 1,000 · None
  3. Where will our data be hosted or processed? Options: Multiple or unknown regions · Outside our home jurisdiction · Within our home jurisdiction only
Access and Integration (Cybersecurity)
  1. How will the service connect to our environment? (select multiple) Options: OAuth grants or API keys with write or admin scopes · Read-only API or OAuth access · Agent or connector installed on our network · Site-to-site VPN or private network link · Directory sync or user provisioning (SCIM) · No integration
  2. Will users sign in through our single sign-on? Options: Not applicable, no user accounts · No, local accounts only · SSO available but not enforced · Yes, SSO enforced
  3. Will the provider’s personnel have access to our data or tenant? Options: Yes, standing administrative access · Yes, on request for support · No, data is encrypted with keys we control
Service Model and Resilience (Financial)
  1. Which service model best describes the offering? Options: SaaS on shared multi-tenant infrastructure · SaaS on dedicated single-tenant infrastructure · PaaS · IaaS or dedicated hosting
  2. What would an outage of the service lasting one day cause? Options: Customer-facing services or core operations stop · Significant internal disruption · Minor inconvenience
  3. Could we export our data and move to another provider within 90 days? Options: No, or the format is proprietary · Yes, with significant effort · Yes, easily
  4. Does the provider rely on subprocessors or another cloud platform to deliver the service? Options: Yes, and they can access our data · Yes, infrastructure only · No · Unknown
  5. What is the expected annual spend? Options: Over US$500,000 · Over US$100,000 up to US$500,000 · Over US$10,000 up to US$100,000 · Up to US$10,000
Typical use: SaaS application onboarding; IaaS and PaaS provider selection; Hosting and colocation reviews; Shadow IT and software purchase requests.
Inherent risk triage for suppliers whose code runs inside our environment or products: custom development, installed and on premises software, libraries and SDKs, and anything that receives automatic updates. Covers execution privilege, update channels, open source dependence, SBOM availability and code signing. Derived from NIST SP 800-218 Secure Software Development Framework (SSDF) v1.1.Where the Code Runs (Cybersecurity)
  1. What kind of software or development work is the supplier providing? (select multiple) Options: Code written for us that ships in our own products · Library, SDK or component embedded in our products · Software installed on our servers, endpoints or network · Browser extension or desktop plugin · Internal tooling with no production use
  2. With what privileges will the software run? Options: Kernel, system or domain administrator level · Elevated service account · Standard user · Sandboxed or isolated Kernel, system or domain administrator level floors the score at 60.
  3. How many of our hosts, devices or customer deployments will run it? Options: Most or all of the fleet, or all customers · A business unit or a large subset · A handful of systems
  4. Will the software or developers handle sensitive data or secrets? Options: Yes, production data, credentials or signing keys · Yes, test or masked data only · No
Build and Update Channel (Cybersecurity)
  1. How are updates delivered? Options: Pushed automatically by the supplier without our approval · Automatic, but we can stage or defer them · Manual, after our own testing · Manual, without our own testing · No updates are available or applied
  2. Will the supplier have access to our source code repositories or CI/CD pipelines? Options: Yes, with write or merge rights · Yes, read-only · No
  3. Are releases cryptographically signed and verifiable by us?
Components and Transparency (Compliance)
  1. How much of the software is built from open source or third-party components? Options: Most of it · Some of it · Little or none · Unknown
  2. Will the supplier provide a software bill of materials (SBOM)? Options: No · On request · Yes, with every release
  3. Is the software end of life, or is the supplier a small team or single maintainer? Options: Yes, end of life or unsupported · Yes, small team or single maintainer · No
  4. Does the engagement require a secure software development attestation?
Typical use: Installed and on premises software procurement; Outsourced or custom software development; Third-party SDKs and libraries in our products; Secure software attestation reviews.
Inherent risk triage for MSPs, MSSPs, MDR providers and IT outsourcers that operate inside our environment. Covers privileged and remote access, remote monitoring and management tooling, administrative rights over cloud tenants and identity, the security functions entrusted to them and how hard they are to replace. Derived from CISA, NSA, FBI and partners: Protecting Against Cyber Threats to Managed Service Providers and their Customers (AA22-131A).Privileged Access (Cybersecurity)
  1. Will the provider hold administrative rights over our identity provider, directory or cloud tenants? Options: Yes, global or domain administrator · Yes, delegated or scoped admin roles · No Yes, global or domain administrator floors the score at 70.
  2. Which systems will the provider manage? (select multiple) Options: Servers and production infrastructure · End user devices · Network and firewalls · Backups and disaster recovery · Security tooling (EDR, SIEM, email security) · Business applications · No customer systems managed
  3. How will the provider access our environment remotely? Options: Persistent remote monitoring and management (RMM) agent on our hosts · Standing VPN or jump host access · Just-in-time access we approve per session · No remote access
  4. Does the provider use shared tooling or credentials across its customers? Options: Yes · Unknown · No, each customer is isolated
Data and Security Functions (Cybersecurity)
  1. What is the most sensitive data the provider can reach? Options: Regulated or restricted data · Confidential business or customer data · Internal data only · None
  2. Will the provider be responsible for detecting or responding to security incidents? Options: Yes, 24x7 detection and response · Yes, business-hours detection and response · Yes, monitoring and alerting only · No
  3. Where are the provider’s operators located? Options: Multiple countries or follow the sun · Outside our home jurisdiction · Within our home jurisdiction only
  4. Will the provider subcontract any part of the service? Options: Yes, with access to our environment · Yes, without access · No
Dependence (Financial)
  1. If the provider stopped service tomorrow, how long could we run IT ourselves? Options: Not at all, we have no in-house capability · A few weeks · Indefinitely
  2. What is the expected annual spend? Options: Over US$500,000 · Over US$100,000 up to US$500,000 · Over US$25,000 up to US$100,000 · Up to US$25,000
Typical use: Managed IT and help desk outsourcing; MSSP, MDR and SOC provider selection; Cloud tenant administration partners; Privileged remote access reviews.
Inherent risk triage for payment processors, gateways, ecommerce platforms, call centers and any third-party service provider that stores, processes or transmits cardholder data or can affect the security of our cardholder data environment. Sizes PCI DSS scope, card volume and how compliance is validated. Derived from PCI DSS v4.0.1 Requirement 12.8: Third-Party Service Provider Management.Cardholder Data Scope (Compliance)
  1. Will the third party store, process or transmit cardholder data on our behalf? Options: Yes · No, but they can affect the security of our cardholder data environment · No Yes floors the score at 60.
  2. Which card data elements will the third party handle? (select multiple) Options: Sensitive authentication data (full track, CVV2, PIN) during authorization · Full primary account number (PAN) · Truncated PAN or tokens only · None
  3. How does card data reach the third party? Options: Through our systems or network before reaching them · Their script or page embedded in our website (iframe, JavaScript) · Full redirect or hosted payment page, never touching our systems · Card present terminals they supply (P2PE) · Phone or manual entry by their staff · No card data received
  4. Will the third party have access to systems in our cardholder data environment? Options: Yes, administrative or remote access · Yes, limited or monitored access · No
Volume and Validation (Compliance)
  1. How many card transactions will the third party handle for us each year? Options: Over 6 million · 1 - 6 million · 20,000 - 999,999 · Fewer than 20,000
  2. How does the third party validate its PCI DSS compliance? Options: It does not, or validation has lapsed · Self-Assessment Questionnaire (SAQ D for service providers) · Report on Compliance (ROC) and Attestation of Compliance from a QSA · Not applicable
  3. Is the scope of their PCI DSS assessment clear about which requirements they meet for us and which remain ours? Options: No responsibility matrix exists · Partially documented · Yes, documented
Financial and Operational Exposure (Financial)
  1. What share of our revenue flows through this third party? Options: More than 50% · 10% - 50% · Less than 10%
  2. Is there a backup payment provider we could fail over to? Options: No · Yes, with manual switchover · Yes, automatic failover
  3. Will the third party handle refunds, chargebacks or payouts on our behalf? Options: Yes, including funds settlement or payouts · Yes, refunds or chargebacks only · No
Typical use: Payment processor and gateway selection; PCI DSS third-party service provider inventory (Req. 12.8); Ecommerce and checkout platform reviews; Contact center and IVR providers taking card payments.
Inherent risk triage for subcontractors and service providers supporting US Department of Defense contracts. Establishes whether Federal Contract Information or Controlled Unclassified Information flows to the supplier, which CMMC level the flowdown requires, export controlled data, cloud hosting of CUI, foreign ownership and DFARS 252.204-7012 incident reporting dependencies. Derived from CMMC Program (32 CFR Part 170) and DFARS 252.204-7012.Covered Information (Compliance)
  1. Will the supplier process, store or transmit Controlled Unclassified Information (CUI) in performance of the subcontract? Options: Yes · Unknown, CUI marking not yet determined · No Yes floors the score at 60.
  2. Will the supplier receive Federal Contract Information (FCI) that is not intended for public release?
  3. Which categories of controlled data are involved? (select multiple) Options: Controlled technical information (CTI) · ITAR controlled technical data · EAR controlled technology (non EAR99) · Covered defense information in other CUI categories · Export control status not yet assessed · None of the above
  4. Which CMMC level does the solicitation or prime contract flow down? Options: Level 3 (DIBCAC assessment) · Level 2 (C3PAO certification assessment) · Level 2 (self-assessment) · Level 1 (self-assessment) · Not yet specified · None, no FCI or CUI involved
Systems and Hosting (Cybersecurity)
  1. Will CUI be stored or processed in a cloud service offering? Options: Yes, in a service without FedRAMP Moderate authorization or equivalency · Yes, in a FedRAMP Moderate authorized or equivalent service · No, on premise only · No CUI involved
  2. Will the supplier connect to our network or systems in scope for CMMC? Options: Yes, with privileged or administrative access · Yes, standard user or integration access · No
  3. Does the supplier provide a security function for our CMMC environment? Options: Yes, it is an external service provider for our enclave · No
  4. Will any foreign persons, or personnel or systems outside the United States, access the controlled data? Options: Yes, including foreign persons · Unknown · No, US persons in the US only
Supplier Profile and Reporting (Compliance)
  1. Is the supplier subject to foreign ownership, control or influence?
  2. Has the supplier posted a current NIST SP 800-171 assessment score in SPRS, as DFARS 252.204-7019 requires?
  3. Would we depend on the supplier to detect and report a cyber incident affecting covered defense information within 72 hours? Options: Yes · Partially · No
  4. Will the supplier further subcontract work involving FCI or CUI? Options: Yes, with CUI · Yes, with FCI only · No
Typical use: CMMC flowdown scoping for subcontractors; CUI handling determination; Defense supplier onboarding; Cloud provider review for CUI hosting.
Inherent risk triage for direct suppliers and service providers of an EU essential or important entity under the NIS 2 Directive. Covers whether the supplier supports a service in scope, whether it is itself a NIS 2 entity, its access to network and information systems, our dependence on it for Article 23 incident notification, and supply chain concentration under Article 21(2)(d). Derived from NIS 2 Directive (EU) 2022/2555 and Implementing Regulation (EU) 2024/2690.Regulatory Scope (Compliance)
  1. How is our organisation classified under NIS 2? Options: Essential entity · Important entity · Classification not yet determined · Not in scope
  2. Does the supplier support the provision of a service that brings us into NIS 2 scope? Options: Yes, the service cannot be provided without it · Yes, it supports the service indirectly · No Yes, the service cannot be provided without it floors the score at 50.
  3. Which NIS 2 provider types describe the supplier? (select multiple) Options: Managed service or managed security service provider · Cloud computing or data centre service provider · DNS, TLD registry or domain name registration · Content delivery network or trust service provider · Software or hardware supplier to our systems · None of the above
System Access and Security Dependency (Cybersecurity)
  1. What access will the supplier have to our network and information systems? Options: Privileged or administrative remote access · Standard user or integration access · Physical access to facilities only · No access
  2. Will the supplier deliver software or firmware updates into our environment? Options: Yes, pushed automatically · Yes, applied by our staff · No
  3. Would a significant incident at the supplier need to reach us fast enough to meet our 24 hour early warning under Article 23? Options: Yes · Possibly · No
  4. Where will the supplier operate the service from? Options: Outside the EU, including high risk jurisdictions · Outside the EU, in adequacy or allied jurisdictions · Within the EU
Resilience and Concentration (Financial)
  1. What is the maximum tolerable outage of this supplier’s service? Options: Less than 4 hours · 4 - 24 hours · 1 - 3 days · More than 3 days
  2. Do other critical services also depend on this supplier? Options: Yes, several · Yes, one other · No
  3. How long would it take to replace this supplier? Options: More than 12 months or no alternative exists · 6 - 12 months · Less than 6 months
  4. Does the supplier rely on subcontractors to deliver the service? Options: Yes, with access to our systems or data · Yes, without access · No
Typical use: NIS 2 supply chain security scoping; ICT supplier onboarding for EU entities; Managed service provider triage; Supplier tiering for Article 21 measures.
Inherent risk triage for ICT third-party service providers of EU financial entities under the Digital Operational Resilience Act. Establishes whether the service supports a critical or important function, what the register of information needs, the subcontracting chain, critical provider designation, data location, exit feasibility and concentration risk under Articles 28 to 30. Derived from Digital Operational Resilience Act, Regulation (EU) 2022/2554.Function Criticality (Compliance)
  1. Does the ICT service support a critical or important function of the financial entity? Options: Yes · Partially, it supports part of such a function · Not yet assessed · No Yes floors the score at 60.
  2. Which type of ICT service is being provided? Options: Cloud infrastructure or platform (IaaS, PaaS) · Core business application or SaaS · Managed IT or security operations · Data, analytics or market data feeds · Other ICT support service
  3. Has the provider been designated a critical ICT third-party service provider (CTPP)?
Data and Location (Cybersecurity)
  1. What data will the provider process or store? (select multiple) Options: Customer personal data · Payment or transaction data · Credentials, keys or authentication data · Confidential business or market data · No data
  2. Where will data be stored and processed? Options: Outside the EU or EEA · Within the EU or EEA, with support access from outside · Within the EU or EEA only
  3. Will the provider have privileged access to our production ICT systems? Options: Yes · Limited or read-only · No
Subcontracting, Concentration and Exit (Financial)
  1. Does the provider rely on subcontractors to deliver the ICT service? Options: Yes, for material parts of a critical or important function · Yes, for non-material parts · Unknown · No
  2. How many of our critical or important functions already depend on this provider? Options: Three or more · One or two · None
  3. How readily could the service be transferred to another provider or brought in house? Options: Not feasible or no alternative exists · Feasible with more than 12 months of effort · Feasible within 6 - 12 months · Feasible within 6 months
  4. What is the expected annual spend with the provider? Options: Over EUR 1,000,000 · Over EUR 250,000 up to EUR 1,000,000 · Over EUR 50,000 up to EUR 250,000 · Up to EUR 50,000
Typical use: Critical or important function assessment; Register of information population; ICT provider pre-contract risk assessment; Concentration risk review.
Inherent risk triage for vendors to colleges and universities. Covers education records under FERPA and the school official exception, student financial aid data under the GLBA Safeguards Rule, research data and export control, data on minors, accessibility, and campus identity integration. Pairs with a HECVAT Lite or Full follow-up for vendors that score high. Derived from FERPA (34 CFR Part 99) and GLBA Safeguards Rule (16 CFR Part 314).Student and Institutional Data (Compliance)
  1. Will the vendor receive personally identifiable information from student education records? Options: Yes · Directory information only · No Yes floors the score at 40.
  2. How many student, applicant or alumni records will the vendor handle? Options: 50,000 or more · 5,000 - 49,999 · Fewer than 5,000 · None
  3. Which categories of sensitive data are involved? (select multiple) Options: Student financial aid or tax data (GLBA) · Social Security numbers or government IDs · Health, counseling or disability records · Payment card data · Employee or HR records · None of the above
  4. Will the vendor collect data from minors, such as K-12 programs or camps? Options: Yes, including children under 13 · Yes, minors aged 13 - 17 · No
  5. Will the vendor handle research data that is export controlled, federally sponsored or subject to a data use agreement? Options: Yes, export controlled (ITAR or EAR) or CUI · Yes, sponsored research or a data use agreement · No
Technology and Access (Cybersecurity)
  1. Will the vendor integrate with the student information system, LMS or ERP? Options: Yes, with write access · Yes, read-only · No
  2. How will users sign in? Options: Separate vendor managed accounts and passwords · Campus SSO (SAML, OIDC or InCommon) · No user accounts
  3. Where will institutional data be hosted? Options: No institutional data processed or stored · Vendor cloud, including outside the United States · Vendor cloud in the United States · On campus infrastructure
Accessibility and Mission Impact (Reputational)
  1. Who will use the product? Options: Students, applicants or the public · Faculty and staff only · A small administrative team
  2. What would happen if the service were unavailable during a peak period such as registration or exams? Options: Instruction, enrollment or financial aid would stop · A department would be significantly degraded · Little or no impact
Typical use: Campus software procurement; FERPA school official review; Choosing between HECVAT Lite and Full; Research collaboration vendor review.
Inherent risk triage for federal, state, local, education and international public bodies, and for suppliers that handle government data. Determines the security categorization, which regulated government data types flow (CUI, CJI, FTI, Medicaid data, student records), which cloud certification the buyer needs (FedRAMP, GovRAMP, TX-RAMP or a national scheme) and how critical the public service is. Derived from FIPS 199 Standards for Security Categorization of Federal Information and Information Systems.Government Data (Compliance)
  1. Which regulated government data types will the vendor handle? (select multiple) Options: Controlled Unclassified Information (CUI) · Criminal justice information (CJI) · Federal tax information (FTI) · Medicaid, CHIP or Marketplace data · Student education records · Election or voter registration data · Other resident or citizen personal data · Classified information · None of the above
  2. What is the security categorization of the system or data under FIPS 199 or the equivalent national scheme? Options: High (or equivalent, such as Protected C or SECRET) · Moderate (or equivalent, such as Protected B or OFFICIAL-SENSITIVE) · Low · Not yet categorized · Public information only High (or equivalent, such as Protected C or SECRET) floors the score at 70.
  3. How many residents, students or beneficiaries do the records cover? Options: 1,000,000 or more · 100,000 - 999,999 · 1,000 - 99,999 · Fewer than 1,000 · None
Hosting, Access and Personnel (Cybersecurity)
  1. What government cloud certification or authorization does the service hold? Options: None or below the required level, cloud hosted · In process or provisional · Certified or authorized at the level we need (FedRAMP, GovRAMP, TX-RAMP or national scheme) · Not applicable, on premises only
  2. Where will government data be stored, processed or accessed from? Options: Stored or processed outside our country · Stored in our country, with offshore support access · Only in our country, by personnel in our country
  3. Will the vendor connect to agency networks, identity systems or shared services? Options: Yes, with privileged or administrative access · Yes, user level or integration access · No
  4. Will vendor personnel need a government background check, fingerprinting or a security clearance? Options: Yes, a clearance or national security vetting · Yes, fingerprint based or public trust checks · No · Unknown
  5. Is the vendor, or any subcontractor, foreign owned or subject to a supply chain prohibition such as NDAA Section 889 or a FASCSA order? Options: Yes, a covered or prohibited source · Foreign owned, not a prohibited source · Unknown · No Yes, a covered or prohibited source floors the score at 90.
Public Service Impact (no risk domain)
  1. Does the service support a critical public function? Options: Yes, public safety, emergency services, utilities or elections · Yes, benefits, payments, licensing or other resident services · Internal administration only Yes, public safety, emergency services, utilities or elections floors the score at 60.
  2. Is the service used directly by residents or the public? Options: Yes · No, staff only
  3. Is the engagement funded by a federal grant or under a federal prime contract?
  4. What is the expected contract value? Options: Over US$1,000,000 · Over US$250,000 up to US$1,000,000 · Over US$25,000 up to US$250,000 · Up to US$25,000
Typical use: Agency IT and cloud procurement; Choosing between FedRAMP, GovRAMP and TX-RAMP; CJIS, IRS Publication 1075 and CMS data flowdown scoping; Public sector supplier onboarding outside the US.
Inherent risk triage for third parties that support important business services. Covers which services depend on the vendor, impact tolerances, how easily the vendor could be substituted, concentration across providers and regions, fourth parties, single points of failure and how feasible an exit would be. Derived from Basel Committee on Banking Supervision, Principles for Operational Resilience (2021).Important Business Services (Financial)
  1. Does the third party support an important or critical business service, one whose disruption would harm customers, market integrity or our viability? Options: Yes · It supports a service that depends on one that is · No Yes floors the score at 60.
  2. How many of our business services rely on this third party? Options: Five or more · Two to four · One
  3. What is the impact tolerance, the maximum disruption the supported service can absorb before causing intolerable harm? Options: Less than 4 hours · 4 to 24 hours · 1 to 3 days · More than 3 days or not defined
  4. Who would be affected if the third party failed? (select multiple) Options: Customers or clients · Counterparties or financial market infrastructure · Regulatory reporting or obligations · Internal operations only
Substitutability and Exit (Financial)
  1. How many credible alternative providers exist for this service? Options: None, the provider is effectively unique · One or two · Three or more
  2. How long would a full exit or transfer to another provider take? Options: More than 12 months · 6 to 12 months · Less than 6 months
  3. Could we run the service in-house or with a manual workaround during a disruption? Options: No workaround exists · Partially, at reduced capacity · Yes, with a tested workaround
  4. Is our data and configuration portable in a usable format on exit? Options: No, or format is proprietary · Partially · Yes
Concentration and Fourth Parties (Cybersecurity)
  1. Do other critical third parties we use rely on the same underlying provider, such as one cloud platform or data center region? Options: Yes, several critical services share it · Yes, one other · No · Unknown
  2. Is the service delivered from a single site, region or data center? Options: Yes, a single location · Multiple locations in one region · Geographically diverse with failover
  3. Does the third party rely on fourth parties that are material to delivering the service? Options: Yes, and they are not disclosed to us · Yes, and they are disclosed · No
Typical use: Important business service mapping; Concentration risk review; Critical supplier designation; Exit planning and substitutability assessment.
Inherent risk triage for suppliers of components, raw materials, finished goods and contract manufacturing. Covers sole sourcing, lead times, geographic and geopolitical exposure, quality and safety impact on our products, logistics, tooling and IP held by the supplier, and financial stability.Supply Continuity (Financial)
  1. Is this supplier the only qualified source for what it provides? Options: Sole source, no alternative exists · Single source, alternatives are not yet qualified · Dual or multi-sourced
  2. How long would it take to qualify a replacement supplier? Options: More than 12 months · 3 to 12 months · Less than 3 months
  3. What is the typical lead time from order to delivery? Options: More than 16 weeks · 4 to 16 weeks · Less than 4 weeks
  4. Where are the supplier’s production sites located? (select multiple) Options: A country subject to sanctions, export controls or active conflict · A region with high natural disaster or political instability exposure · A single site with no backup facility · Multiple stable locations
  5. How is product shipped to us? Options: International freight through a single port or chokepoint · International freight with alternative routes · Domestic or regional ground transport
Quality, Safety and Product Compliance (Compliance)
  1. What would a defect in the supplier’s output affect? Options: Safety of a finished product or end user · Function or performance of a finished product · Packaging, cosmetic or non-critical attributes · Indirect materials or supplies only Safety of a finished product or end user floors the score at 60.
  2. Which product regulations apply to what the supplier provides? (select multiple) Options: Medical device, pharmaceutical or food safety rules · Chemical restrictions such as REACH, RoHS or TSCA · Consumer product safety rules · Export controls such as ITAR or EAR · Conflict minerals or forced labor import rules · None of the above
  3. Does the supplier hold a relevant certified quality management system? Options: No · In progress · Yes, such as ISO 9001, ISO 13485 or IATF 16949
Commercial and Financial Exposure (Financial)
  1. Does the supplier hold our tooling, molds, designs or other intellectual property? Options: Yes, proprietary designs or trade secrets · Yes, tooling or molds we own · No
  2. What share of the supplier’s revenue does our business represent? Options: More than 30% · 10% to 30% · Less than 10% · Unknown
  3. Are there known signs of financial stress at the supplier? Options: Yes, such as late deliveries, payment term demands or credit alerts · Unknown · No
  4. What is the expected annual spend with this supplier? Options: Over US$5,000,000 · Over US$1,000,000 up to US$5,000,000 · Over US$100,000 up to US$1,000,000 · Up to US$100,000
Typical use: Direct materials supplier onboarding; Contract manufacturer qualification; Sole source and dual sourcing review; Supply chain disruption planning.
Inherent risk triage for consulting firms, staff augmentation, contractors and onsite service providers. Covers system accounts and physical access, background screening, offshore staff, ownership of deliverables, co-employment and whether their advice feeds regulated decisions.Access to Systems and Data (Cybersecurity)
  1. Will the provider’s staff receive accounts in our systems? Options: Yes, with administrative or privileged access · Yes, standard user access · No
  2. What is the most sensitive data the provider’s staff will see? Options: Regulated or restricted data (health, financial, government ID) · Confidential business or customer data · Internal data only · No data
  3. What devices will the provider’s staff use to do the work? Options: Their own or their firm’s unmanaged devices · Their firm’s managed devices · Devices or virtual desktops we provide · No computing devices used for the work
  4. Will any of the provider’s staff work from outside our country of operation? Options: Yes, with access to our data · Yes, without data access · No
People and Physical Access (Cybersecurity)
  1. Will the provider’s staff work onsite at our premises? Options: Yes, with unescorted access to restricted areas · Yes, in general office areas or escorted · No, remote only
  2. Does the provider background screen staff assigned to us to a standard equal to our own?
  3. How many of the provider’s people will work on the engagement? Options: More than 25 · 6 to 25 · 1 to 5
  4. Will the contractors work under our day to day direction, embedded in our teams for an extended period? Options: Yes, for more than 12 months · Yes, for up to 12 months · No, they deliver a defined scope under their own management
Deliverables and Reliance (Compliance)
  1. Will we rely on the provider’s work for any of these purposes? (select multiple) Options: Regulatory filings or compliance decisions · Financial reporting or audit · Legal, tax or actuarial advice · Production code or system configuration · None of the above
  2. Is ownership of the deliverables and any work product clearly assigned to us? Options: No, or the provider retains rights · Not yet agreed · Yes, assigned to us in the contract
  3. What is the expected value of the engagement? Options: Over US$1,000,000 · Over US$250,000 up to US$1,000,000 · Over US$50,000 up to US$250,000 · Up to US$50,000
Typical use: Consulting engagement intake; Staff augmentation and contractor onboarding; Facilities and onsite service providers; Statement of work review.
Inherent risk triage for suppliers whose labor practices, sourcing or environmental footprint could create legal or reputational exposure. Covers labor-intensive sectors, high-risk sourcing regions, recruitment fees, conflict minerals, emissions relevance and the due diligence laws that apply. Derived from OECD Due Diligence Guidance for Responsible Business Conduct (2018).Labor and Human Rights (Reputational)
  1. Which best describes the third party’s work for us? Options: Labor-intensive production (agriculture, textiles, electronics assembly, mining, fishing) · Onsite services (cleaning, security, construction, catering) · Logistics, warehousing or manufacturing · Professional, software or digital services
  2. Does the third party rely on migrant, contract or agency workers? Options: Yes, and workers may pay recruitment fees or use labor brokers · Yes, through vetted agencies with no worker-paid fees · Unknown · No
  3. Will workers be housed in employer-provided accommodation?
  4. Has the third party faced allegations, media reports or enforcement for labor or human rights abuses in the last five years? Options: Yes, substantiated or unresolved · Yes, resolved with remediation · No
Sourcing Geography and Materials (Compliance)
  1. Could goods or inputs originate, even partly, in the Xinjiang Uyghur Autonomous Region or from entities on the UFLPA Entity List? Options: Yes · Unknown, supply chain not mapped · No, traced and confirmed Yes floors the score at 75.
  2. Does the third party source from other regions with elevated forced labor, child labor or conflict risk?
  3. Which high-risk materials are present in what the third party supplies? (select multiple) Options: Tin, tantalum, tungsten or gold (3TG) · Cobalt, mica or other critical minerals · Cotton, polysilicon or tomatoes · Palm oil, cocoa, coffee, soy, cattle, rubber or timber · Seafood · None of the above
Environment and Regulatory Scope (Compliance)
  1. How significant is this third party to our Scope 3 greenhouse gas emissions or environmental footprint? Options: Major contributor (top suppliers by emissions or spend) · Moderate contributor · Negligible
  2. Does the third party operate hazardous processes or handle significant waste, water or chemical discharges?
  3. Which supply chain due diligence or disclosure laws apply to this relationship? (select multiple) Options: EU Corporate Sustainability Due Diligence Directive · German Supply Chain Due Diligence Act (LkSG) · UK Modern Slavery Act 2015 · Uyghur Forced Labor Prevention Act · EU Forced Labour Regulation · None of the above
Typical use: Supplier human rights due diligence; Forced labor and import compliance screening; Scope 3 emissions supplier prioritization; CSDDD, LkSG and Modern Slavery Act scoping.
Inherent risk triage for agencies, ad tech, contact centers and engagement platforms that speak to customers in our name. Covers brand representation, calls and texts, email, tracking and data sharing, children’s data, endorsements, complaint handling and access to our social media accounts.Brand and Customer Contact (Reputational)
  1. Will the third party communicate with customers or the public in our name? Options: Yes, directly and without our review of each message · Yes, using content we approve in advance · No, it works behind the scenes only
  2. Which outbound channels will the third party use on our behalf? (select multiple) Options: Phone calls, including autodialed or prerecorded · SMS or messaging apps · Commercial email · Direct mail · Paid or organic social media · None
  3. Will the third party use influencers, affiliates, testimonials or reviews to promote us? Options: Yes, paid or incentivized endorsements · Yes, organic reviews or testimonials only · No
  4. Will the third party receive or handle customer complaints? Options: Yes, and it resolves them without our involvement · Yes, it logs and escalates them to us · No
  5. Will the third party have access to our social media or advertising accounts? Options: Yes, with admin or publishing rights · Yes, analytics or read-only · No
Consumer Data and Tracking (Compliance)
  1. Will the third party place tags, pixels, SDKs or cookies on our websites or apps? Options: Yes, and it uses the data for its own purposes · Yes, limited to providing the service to us · No
  2. Will customer data be sold or shared for cross-context behavioral advertising?
  3. How many consumer records will the third party hold or process? Options: 1,000,000 or more · 100,000 - 999,999 · 10,000 - 99,999 · Fewer than 10,000 · None
  4. Could the audience include children under 13 or teens? Options: Yes, directed at children under 13 · Yes, teens or a mixed audience · No, adults only Yes, directed at children under 13 floors the score at 60.
  5. Which sensitive data will be used for targeting or segmentation? (select multiple) Options: Precise geolocation · Health or wellness interests · Financial status or credit data · Race, religion, sexual orientation or other protected traits · None of the above
Typical use: Marketing agency and ad tech onboarding; Contact center and SMS platform review; Influencer and affiliate program setup; Website tag and pixel approval.

​
How the score works

Each answer option carries a weight. The inherent risk score is the total of the weights you selected, divided by the highest total those same questions could have produced, expressed as a percentage from 0 to 100. That score then maps to an inherent risk level through the scale configured under Configuration → Scales → Risk. Two things follow from that normalization:
  • Weights are relative. They only have to be right against each other, so you can add, remove or reword questions without rebalancing the whole questionnaire.
  • Context questions are free. Free-text, contact, country and currency questions never affect the score, so you can ask for the business owner or a service description without skewing the rating.
Some answers set a score floor instead of adding to the total. Seventeen templates use one: When one of those answers is picked, the questionnaire cannot score below that floor no matter how the other questions are answered. Sections are mapped to risk domains (Cybersecurity, Compliance, Financial, Reputational), so a copied template also produces per-domain inherent risk scores alongside the overall one. Sections with no domain, such as Business Impact, still count toward the overall score unless you weight your risk domains.

​
Weighting risk domains

By default every scoring question counts toward the overall score on equal terms, so a domain’s influence is whatever its questions add up to. To make a domain count for a fixed share instead, go to Configuration → Risk Domains and fill in Weight in IRQ score for the domains you care about. Once any domain carries a weight, the overall score becomes a weighted average of the domain scores:
  • Weights are normalized by the total of the domains that scored, so they do not have to add up to 100, and an unanswered domain does not drag the score down.
  • Answers in a section with no risk domain, or whose domain has no weight, no longer count. The submission’s How this score was weighted table names how many answered questions were left out.
  • A score floor still applies after the weighting.
Leave every weight empty to keep the unweighted calculation.

​
Tailoring your copy

Everything is editable once you have copied a template. The adjustments worth making first:
  • Reword the spend bands to match your own thresholds and currency. The shipped bands are US dollars and will be wrong for most workspaces.
  • Adjust weights in the Value column on each option to reflect your risk appetite.
  • Add a score floor on any option that should guarantee a minimum rating, your own equivalent of the critical-activity question.
  • Delete what you will not act on. A question whose answer never changes the due diligence you run is a question that costs you response rates.
  • Wire it into intake from Actions → Intake Configuration so new vendor requests are rated automatically.
  • Set risk levels from Actions → Configure Risk Levels to control where the score lands.

​
Use the library from MCP or the API

You can browse the library and fork a template from an MCP client, and browse it with an API key. An MCP client reads with query_questionnaires(kind="irq_library") and forks a template with mutate(entity="questionnaire", action="create_from_library"), using the slug the read returns. With an API key, GET /v1/irq-library lists the templates. See List the IRQ library. Before an MCP client sends a write, it shows you the change and waits for you to confirm it. The MCP tool reference lists every field.

​
Where to go next

Requesting a vendor

How an intake request flows through the questionnaire you wired in, and what the requester sees.

Running an assessment

What happens after the inherent risk score lands: scoping, sending, and reviewing the control assessment it triggers.

Zero touch assessments

Letting a low inherent risk score close out due diligence without a human in the loop.

Admin setup

Risk scales, risk levels and the configuration the inherent risk score maps into.