Vendor Due Diligence

⚠️ EXPERIMENTAL — This skill is provided for educational and informational purposes only. It does NOT constitute legal advice. All responsibility for usage rests with the user. Consult qualified legal professionals before acting on any output.

Vendor Due Diligence Skill

Overview

Production-ready framework for assessing IT service providers, technology vendors, and third-party partners. Provides a Three-Phase Assessment (Initial Screening, Detailed Assessment, Final Evaluation), Multi-Factor Risk Scoring across 6 dimensions with critical-service weighting, regulatory compliance checklists for 8 frameworks, vendor comparison matrices, and ongoing monitoring with Early Warning Indicators. Designed for procurement teams, legal counsel, IT security, and compliance officers evaluating technology vendors.

Table of Contents

• Tools
• Reference Guides
• Workflows
• Troubleshooting
• Success Criteria
• Scope & Limitations
• Anti-Patterns
• Tool Reference

Clarify First

Before scoring the vendor, confirm these inputs. If any is unknown or vague, ASK — do not assume:

• Is the service critical/essential — the --critical flag applies a 2x weight to security and compliance, which can flip the composite score and the Approve/Reject recommendation
• Applicable regulatory frameworks — GDPR, DORA, NIS2, SOX, PCI DSS, ISO 27001/SOC 2, HIPAA, FedRAMP — selects which compliance checklists run
• Questionnaire responses + independent evidence — the 6-dimension scores; self-reported-only data inflates scores, so confirm whether SOC 2 / pen-test / financial evidence backs them

Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the assessment.

Tools

1. Vendor Risk Scorer (scripts/vendor_risk_scorer.py)

Scores a vendor across 6 risk dimensions based on questionnaire responses. Calculates weighted composite score with 2x multiplier for critical services. Generates risk heat map and overall recommendation.

# Score a vendor from questionnaire responses
python scripts/vendor_risk_scorer.py vendor_responses.json

# JSON output for dashboards
python scripts/vendor_risk_scorer.py vendor_responses.json --json

# Flag as critical service (2x weight on security + compliance)
python scripts/vendor_risk_scorer.py vendor_responses.json --critical

2. Vendor Comparison (scripts/vendor_comparison.py)

Takes multiple vendor risk assessment JSONs and generates a side-by-side comparison matrix. Ranks vendors by composite score and recommends preferred vendor with rationale.

# Compare two vendors
python scripts/vendor_comparison.py vendor_a.json vendor_b.json

# Compare multiple vendors with JSON output
python scripts/vendor_comparison.py vendor_a.json vendor_b.json vendor_c.json --json

# Compare with critical service weighting
python scripts/vendor_comparison.py vendor_a.json vendor_b.json --critical

Reference Guides

Workflows

Workflow 1: Three-Phase Vendor Assessment

Phase 1: Initial Screening (Days 1-5)

1. Gather basic vendor information (company profile, financial health, certifications)
2. Run vendor_risk_scorer.py with preliminary data for initial risk classification
3. Check applicable regulatory frameworks from regulatory_checklists.md
4. Decision gate: Proceed to detailed assessment or reject early

Phase 2: Detailed Assessment (Days 5-15)

1. Issue comprehensive vendor questionnaire covering all 6 risk dimensions
2. Run vendor_risk_scorer.py with complete questionnaire responses
3. Execute regulatory compliance checklists for all applicable frameworks
4. Request supporting documentation (SOC 2 reports, pen test results, financials)
5. Conduct reference checks and public record searches

Phase 3: Final Evaluation (Days 15-20)

1. Run vendor_comparison.py if evaluating multiple vendors
2. Compile Vendor Risk Report with dimension breakdowns
3. Document gaps and required mitigations from risk_assessment_framework.md
4. Present recommendation (Approve / Approve with Conditions / Reject)
5. If approved, generate onboarding checklist from monitoring_framework.md

Workflow 2: Competitive Vendor Selection

1. Define requirements -- Document must-have and nice-to-have criteria mapped to risk dimensions
2. Screen candidates -- Run initial scoring on all candidates; eliminate any with Critical risk
3. Deep-dive finalists -- Full 6-dimension assessment on top 2-3 vendors
4. Compare -- Run vendor_comparison.py on finalist assessments
5. Negotiate -- Use risk findings as leverage in contract negotiations (integrates with tech-contract-negotiation skill)
6. Select and onboard -- Approve preferred vendor; set up monitoring per monitoring_framework.md

Workflow 3: Ongoing Vendor Monitoring

1. Quarterly review -- Re-score vendor using updated data; compare against baseline
2. Event-triggered review -- Re-assess on M&A, breaches, regulatory changes, or leadership turnover
3. Annual re-assessment -- Full 6-dimension re-evaluation with updated questionnaire
4. Early Warning response -- Monitor indicators from monitoring_framework.md; escalate per defined paths
5. Exit planning -- If risk exceeds threshold, activate exit provisions and dual-source strategy

Troubleshooting