What is vendor tiering? A practical guide to the four tiers

Vendor tiering is the practice of placing every third party in a risk band, or tier, based on how much harm it could cause if it failed or was compromised. The tier then sets how much oversight the vendor receives: the evidence you collect, how deep the assessment goes, who signs off and how often you reassess.

Without tiers, the catering supplier gets the same 300-question review as the payment processor. This guide explains the four-tier model, what decides a tier, what changes at each level and when to reopen it.

Why should you tier vendors?

Regulators expect scrutiny that matches the risk. The US Interagency Guidance on Third-Party Relationships: Risk Management, issued in June 2023 by the Federal Reserve, the FDIC and the OCC, states that "not all relationships present the same level of risk." It asks banking organizations to tailor their risk management to each relationship, with more comprehensive and rigorous oversight for relationships that support higher-risk activities, including critical activities.

In the EU, the Digital Operational Resilience Act (Regulation (EU) 2022/2554) applies the same idea: Article 28 asks financial entities to manage ICT third-party risk proportionately, taking into account the criticality or importance of each service.

Tiering turns that principle into a repeatable, documented decision, and it protects capacity: deep reviews go to the few vendors that matter most, and everyone else still gets a defensible baseline.

What are the four vendor tiers?

Most mature programs use four tiers plus a formal exemption. The examples are typical; the right tier depends on how you use the vendor.

Tier 1 is about dependency, Tier 2 is about sensitivity

A common mistake is placing every vendor that touches personal data in Tier 1. A payroll processor holds highly sensitive data, yet most organizations could replace it within a quarter. It belongs in Tier 2: a deep security and privacy review, without the resilience and exit planning a true dependency needs.

Keep Tier 1 small: a common target is roughly 5 to 10 percent of vendors. If a third of your portfolio is Tier 1, the label stops meaning anything.

Exempt is not a fifth tier

An exemption takes a genuinely out-of-scope relationship out of the program. It should carry a written reason, approval by someone other than the requester and, where useful, a re-review date. Otherwise "exempt" becomes a place where risky vendors hide.

What decides a vendor's tier?

The tier should come from a short criticality questionnaire answered by the business owner and reviewed by a TPRM analyst, who challenges answers that do not match the contract. A typical model scores six weighted factors:

1. Data sensitivity: the types and volume of data involved.
2. System and network access: from none to privileged production access.
3. Business criticality and dependency: what stops if the vendor stops.
4. Regulatory and compliance exposure.
5. Financial exposure.
6. Replacement difficulty: how long and costly an exit would be.

Good models add four guardrails to the score:

• Knockout floors. Some answers set a minimum tier instead of adding points. For example, "business-stopping if unavailable" sets Tier 1, and regulated data or privileged production access sets at least Tier 2. The final tier is the higher of the score tier and the floor.
• Overrides with justification. An analyst can change the calculated tier with a written reason. Both tiers stay on the record.
• Concentration. Heavy reliance on a provider that many of your critical vendors share can raise a tier. It should never lower one.
• Unreviewed means critical. A vendor with no completed criticality review is treated as critical until reviewed, so skipping the review is never convenient.

A tier is not the same as inherent risk

The tier measures impact. Inherent risk combines that impact with exposure, the likelihood side driven by data, access and regulatory factors, so two Tier 2 vendors can carry different inherent risk. See how to map vendor tiers to inherent risk.

What changes from one tier to the next?

A tier is only useful if it changes the work. The table shows one example policy.

Treat the reassessment intervals as a common starting point, not a rule. Cadence is configurable per program, and regulated organizations often keep tighter maximums.

Tier 1 relationships also need an exit plan. DORA Article 28(8), for example, requires exit strategies for ICT services that support critical or important functions.

In the VendRisk360 vendor lifecycle, a criticality questionnaire sets each vendor's tier from Tier 1 Critical to Tier 4 Low, and your policy defines what each tier requires (evidence, questionnaire depth and sign-off chain), and the platform applies it. Teams that want experts to do the work can use vendor risk assessments scaled to the tier.

When should you re-tier a vendor?

A tier is a snapshot of the relationship as it was scoped. Reopen it when the facts change:

• A new service, data type or level of system access.
• Greater dependency, for example after consolidating onto a sole provider.
• An ownership change, merger or restructuring at the vendor.
• A security incident or serious monitoring alert.
• Contract renewal.
• A new regulatory designation, such as supporting a critical or important function.

Confirm the tier at every scheduled reassessment too.

Does tiering replace continuous monitoring?

No. Tiering decides how much attention a vendor gets. Monitoring tells you when something changed. A Tier 3 vendor breached on Tuesday should not wait 24 months for its next review. The interagency guidance notes that ongoing monitoring can be periodic or continuous, with more frequent monitoring for higher-risk relationships.

The tier sets how closely each vendor is watched, and a confirmed signal can bring the next reassessment forward. With VendRisk360 continuous monitoring, confirmed signals land on the vendor record, where your team can raise a finding or pull the reassessment date forward.

Frequently asked questions

How many vendor tiers should a TPRM program use?

Most programs use four tiers (Critical, High, Medium and Low) plus a formal exemption for out-of-scope relationships. Four tiers separate a critical dependency from a sensitive but replaceable vendor without endless debate about boundaries. More important than the number is that each tier changes the evidence, monitoring, sign-off and reassessment cadence.

What percentage of vendors should be Tier 1 Critical?

A common target is roughly 5 to 10 percent of the vendor portfolio. Tier 1 should hold only vendors that support a critical activity and are hard to replace. If a much larger share lands in Tier 1, the criteria are usually mixing data sensitivity with dependency, and sensitive but replaceable vendors belong in Tier 2 instead.

Who should decide a vendor's tier?

The business owner answers a criticality questionnaire, because they know what the organization is buying and how much it depends on the service. A TPRM analyst then reviews the answers against the contract and challenges inconsistencies. If the analyst overrides the calculated tier, the written justification is recorded alongside both the calculated and the final tier.

Is an exempt vendor the same as a Tier 4 vendor?

No. A Tier 4 Low vendor is in scope and receives a light review, such as an attestation with sanctions and public-source checks. An exempt relationship is outside the program altogether, for example a one-time purchase. Exemptions need a written reason, approval by someone other than the requester and, where useful, a date to review the exemption again.