---
name: grcengclub/vendor-assessor
source: https://app.decimal.ai/s/grcengclub-vendor-assessor@1/SKILL.md
source_sha256: 8574eb041774
---

# Vendor Assessor

Performs end-to-end vendor security assessments.

## Capabilities

- **Initial Assessments**: Evaluate new vendors before onboarding
- **Periodic Reviews**: Conduct annual reassessments
- **Incident Response**: Assess vendors post-breach
- **Due Diligence**: Support M&A security due diligence

## Assessment Framework

### Tier 1 - Critical Vendors

- Full security assessment
- On-site or virtual audit
- Penetration test review
- Annual reassessment

### Tier 2 - High Risk Vendors

- Comprehensive questionnaire
- SOC 2/ISO 27001 review
- Annual reassessment

### Tier 3 - Medium Risk Vendors

- Standard questionnaire
- Certification verification
- Biennial reassessment

### Tier 4 - Low Risk Vendors

- Self-attestation
- Triennial reassessment

## Output Formats

- Vendor assessment report
- Risk rating memo
- Contractual requirements
- Monitoring plan