A robust supplier risk scoring combines external cyber intelligence data (360TPRM) with internal criticality assessments into a unified, comparable score.
Scoring dimensions and weighting
A proven supplier risk scoring covers 4 dimensions: (1) Cyber risk score (40% weight): measured externally by 360TPRM, updated daily, objective and resistant to manipulation. (2) Criticality (30%): process dependency, data access, system access, substitutability — assessed internally. (3) Compliance status (20%): certificates (ISO 27001, SOC 2), regulatory obligations, audit results. (4) Dependency depth (10%): supplier concentration, sub-supplier exposure, contract term.
The 360TPRM cyber risk score is the objective anchor of the scoring. Internal factors (criticality, compliance) are added on top. The result is a complete, balanced picture.
Putting the scoring into practice
Practical implementation of the scoring: document the scoring formula and have it approved by management, assess every supplier initially, record the score in 360TPRM as additional information, derive monitoring intensity automatically from the score (score < 50: daily monitoring + immediate alert, score 50-70: weekly review, score > 70: monthly review), communicate scoring results regularly (management dashboard).
A scoring that's defined but has no consequences for monitoring intensity, contract requirements or exit decisions won't be taken seriously. Scoring needs to be embedded in operational processes.
FAQ
Implement supplier risk scoring
See in a 45-minute demo how 360TPRM specifically meets your requirements.
Request free demo →