The structured methodology for determining a vendor's risk level before any controls or mitigations are considered — using observable relationship characteristics only.
VIRA™ — Vendor Inherent Risk Assessment — is the proprietary methodology that powers VendorSoluce® inherent risk scoring. It is the structured process for determining how much risk a vendor relationship represents to your organization, evaluated entirely from observable facts about the relationship itself.
VIRA produces a scored inherent risk tier — Critical, High, Medium, or Low — that tells your procurement and security teams what level of due diligence is required before onboarding or renewing a vendor. It is not a security assessment. It does not evaluate what the vendor has done to protect themselves. It evaluates what they represent to you.
Most organizations send the same 200-question security questionnaire to every vendor regardless of risk level. This wastes resources on low-risk vendors and — more critically — fails to calibrate effort toward the relationships that actually matter.
VIRA solves this by establishing the risk baseline before any vendor interaction begins. A vendor cannot influence their inherent risk score by presenting certifications or pointing to controls. The score reflects structural facts: what data they process, how deeply they're integrated, how critical their service is, and what regulatory obligations attach. These facts are determined by your organization, not self-reported by the vendor.
This matters for three specific reasons when a regulator, auditor, or customer asks about your third-party risk program:
VIRA evaluates inherent risk across five domains, each scored 0–100 and combined using a weighted formula. Domains are weighted to reflect their empirical contribution to third-party breach impact, grounded in NIST SP 800-161 Rev 1 (C-SCRM) guidance.
Each domain is scored independently on a 0–100 scale using observable inputs. Domain scores are then combined using a weighted formula to produce a raw inherent score. Non-negotiable override conditions may elevate the final tier above the weighted result.
All domain inputs are capped at 100. Within each domain, factors are individually weighted and summed, then capped. This prevents any single factor from producing an artificially extreme domain score while still reflecting the compounding effect of multiple high-risk inputs.
Partial scores are not interpolated. Each observable input produces a discrete point value — there are no fuzzy or probabilistic inputs. This keeps the methodology auditable: every point in the score traces to a specific observed characteristic.
Four conditions force a minimum tier regardless of the weighted score. These exist because the domain-weighted average can mask a single catastrophic risk factor. A vendor with a 20/100 weighted score who has privileged access to your production database should never be classified as Low risk.
Overrides are evaluated after the weighted score is calculated. If the calculated tier is already at or above the override minimum, no change is made. If it is below, the score is elevated to the minimum value for the required tier.
| Condition | Rationale | Minimum tier |
|---|---|---|
| Tier 1 sensitive data processing (Health, Biometric, Children's data) |
Regulatory penalties and reputational consequences of a breach involving these categories are disproportionately severe. HIPAA, COPPA, and GDPR Art. 9 impose significantly elevated obligations. | High |
| Privileged or admin system access | Privileged access enables lateral movement, credential harvesting, and complete environment compromise. A vendor with admin credentials represents a standing threat actor if their own systems are compromised. | High |
| Sole provider of a mission-critical function (no documented alternative) |
Single-source dependency on a mission-critical function creates systemic risk that cannot be mitigated through vendor controls alone. The organization's resilience is structurally dependent on this vendor's continuity. | High |
| Regulated processing requiring a BAA (HIPAA Business Associate Agreement) |
HIPAA mandates a signed BAA before any PHI sharing. The legal obligation and downstream liability exposure — regardless of the vendor's security posture — requires at minimum standard due diligence. | Medium |
VIRA produces four output tiers. The tier determines the required due diligence level before onboarding approval — not just a label, but a prescribed process depth.
The inherent risk tier determines the minimum due diligence process required before onboarding approval. These requirements are prescribed — they are not negotiable based on vendor size, relationship history, or contract value. The tier reflects structural risk; due diligence requirements follow from the tier.
VIRA is conducted as the first step in the VendorSoluce® vendor lifecycle — before any vendor interaction, questionnaire, or evidence collection. The process is completed by the organization's risk or procurement team, not by the vendor.
VIRA's scope ends at the inherent risk score. Understanding what falls inside and outside that boundary is essential to using the methodology correctly.
| Factor | Inherent risk (VIRA) | Residual risk (post-VIRA) |
|---|---|---|
| Who determines it | Your organization — from observed relationship facts | Evaluated jointly — questionnaire responses, certifications, evidence |
| Vendor certifications | Not considered — SOC 2, ISO 27001 do not affect inherent score | Primary inputs — reviewed and verified during due diligence |
| Security questionnaire | Not used — inherent risk precedes vendor interaction | Required — depth calibrated to inherent risk tier |
| When it changes | When the nature of the relationship changes — new data access, new integration, expanded scope | When vendor controls improve or deteriorate — new certifications, findings, incidents |
| Can vendor improve it? | No — inherent risk reflects the relationship, not vendor actions | Yes — better controls, evidence, and certifications reduce residual risk |
| Audit defensibility | Fully auditable — every point traces to an observable input | Depends on evidence quality and documentation discipline |
VIRA is grounded in established third-party risk management standards. The five-domain structure and weighting rationale draw directly from the following frameworks:
The VIRA assessment takes approximately 15 minutes per vendor. Results feed directly into your vendor portfolio — no backend required.