Lion Cipher Lab
Tier vendors by inherent risk and test the tiers against incidents
- GRC / Compliance
- Intermediate
- ~40 min
- Free · no account required
Why it matters
No organization can assess every vendor deeply, so third-party risk programmes sort vendors into tiers. Tier 1 gets full due diligence and continuous monitoring, tier 3 gets a light check. NIST CSF 2.0 makes this explicit: suppliers are known and prioritized by criticality (GV.SC-04), and NIST SP 800-161 describes assessing suppliers according to their criticality. The tiering decision quietly determines where every later hour of review goes, and it is often made with a convenient proxy: how much you spend with the vendor. This lab builds two tiering models, one by spend and one by an…
What you'll learn
- why vendors are tiered, and what each tier gets
- the spend proxy and why it misleads
- an inherent-risk score from data, access and criticality
- testing a tiering model against incident history
- why access into your estate matters as much as data
- the overfitting trap with small incident counts
- documenting and reviewing a tiering method
Steps in this lab
- Why tier, and what decides a tier
- The vendor list
- Write the two models
- Run it: spend versus inherent risk
- Reweight for access, and resist overfitting