📊 Scoring Methodology
Understanding the weighted risk calculation and compliance rating system
How Scoring Works
The Vendor Risk Assessment Tool uses a weighted scoring algorithm to calculate accurate risk ratings. Unlike simple yes/no checklists, our system accounts for the criticality of each security control.
Question Weights (1-5)
| Weight | Criticality | Example Controls |
|---|---|---|
| 5 | Critical | MFA, Data Encryption, Incident Response Plan, CISO Role |
| 4 | High | Access Reviews, Vulnerability Scanning, Security Training |
| 3 | Medium | Password Policies, Log Retention, Physical Security |
| 2 | Low | Visitor Logs, Asset Labeling, Policy Review Frequency |
| 1 | Minimal | Documentation Standards, Awareness Posters |
Answer Types & Point Allocation
✅
Yes
Full credit awarded
100% of weight
⚠️
Partial
Control exists but incomplete
50% of weight
❌
No
Control not implemented
0 points
N/A (Not Applicable): Questions marked as N/A are excluded from both the achieved and maximum score calculations.
Score Calculation Formula
Compliance Score = (Achieved Points ÷ Maximum Points) × 100
Higher percentage = Better security posture
Achieved Points
- • "Yes" answers: Full question weight
- • "Partial" answers: 50% of weight
- • "No" answers: 0 points
- • Sum all achieved points
Maximum Points
- • Sum of all question weights
- • Excludes N/A questions
- • Represents perfect score (100%)
Example Calculation
Scenario: Quick Due Diligence (10 questions)
| Question | Weight | Answer | Points |
|---|---|---|---|
| Is MFA enabled? | 5 | ✅ Yes | 5.0 |
| Is data encrypted? | 5 | ✅ Yes | 5.0 |
| Security patches in 30 days? | 4 | ⚠️ Partial | 2.0 |
| Incident response plan? | 4 | ✅ Yes | 4.0 |
| Daily backups tested? | 5 | ❌ No | 0.0 |
| Relevant certifications? | 3 | ⚠️ Partial | 1.5 |
| Annual security training? | 4 | ✅ Yes | 4.0 |
| 90-day log retention? | 3 | ✅ Yes | 3.0 |
| Vendor assessments? | 3 | ❌ No | 0.0 |
| BAA/DPA signing? | 5 | ✅ Yes | 5.0 |
Achieved Points
29.5
Maximum Points
41
Compliance Score
71.95%
⚠️ Medium Risk
Risk Rating Bands
🟢
Low Risk (85-100%)
Strong security posture with comprehensive controls
✓
🟡
Medium Risk (60-84%)
Acceptable with remediation plan for gaps
⚠
🔴
High Risk (0-59%)
Significant security deficiencies requiring immediate attention
✗
Assessment Best Practices
- ✓ Request Evidence: Ask vendors to provide documentation (policies, certifications, audit reports) to support their answers.
- ✓ Use "Partial" Wisely: Reserve for controls that exist but have known gaps (e.g., MFA enabled for some users but not all).
- ✓ Add Context Notes: Use the evidence/notes field to document specific findings or follow-up items.
- ✓ Re-Assess Annually: Security posture changes over time. Schedule annual reassessments for critical vendors.
- ✓ Adjust Weights: Customize question weights in the Template Builder to match your organization's risk tolerance.