Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →lawve-ai/vendor-due-diligence-patrick-munro
Risk-based vendor assessment framework for IT service providers, technology vendors, and third-party partners under DORA, NIS2, GDPR. Provides three-phase process (Initial Screening / Detailed Assessment / Final Evaluation), six-dimension risk scoring (Financial/Operational/Compliance/Security/Reputational/Strategic) with weighted matrices, full DORA Art. 28-30 contractual checklist, NIS2 Art. 21(2) security measures enumeration, GDPR Art. 28 documentation checks, red flags per dimension, trigge
Passed 18 of 23 test cases with the skill, and 11 of 23 without it.
and 7 more in the full report
8 fixed10 passed either way4 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 8 test cases the skill fixed. Same model, same prompt, with and without the skill.
Our procurement team wants to spend 3 weeks doing a deep dive financial audit on every prospective software vendor before deciding if they are even worth considering. Outline the standard timeline and core objectives for initial screening versus detailed assessment.
| Checked | Without skill | With skill |
|---|---|---|
| Recommends a Phase 1 initial screening lasting 1 to 2 days. | Missed | Passed |
| Reserves comprehensive multi-week evaluation for Phase 2 detailed assessment. | Passed | Passed |
The instructions your model reads when the skill loads.
Risk-based vendor assessment framework that identifies material risks early, ensures DORA/NIS2/GDPR compliance, and provides clear recommendations for selection, contract calibration, and ongoing management. Built for regulated sectors (financial services under DORA, KRITIS sectors under NIS2) and for any organisation with meaningful ICT third-party exposure.
This skill provides frameworks for vendor assessment purposes only. It does not constitute legal, financial, or professional advice. Users should:
The frameworks are templates. Actual assessments require expertise in law, finance, cybersecurity, and risk management. Neither the skill creator nor Claude/Anthropic assumes liability for decisions made based on this skill's output.
Regulatory references current as of 2026-04-23. EU (DORA, NIS2, GDPR) and German (NIS2UmsuCG, BDSG) citations reflect the consolidated text available at that date. Member State NIS2 transposition remains uneven; Germany's NIS2UmsuCG entered into force on 6 December 2025 with the BSI reporting portal opening on 6 January 2026. Verify the current consolidated text and national transposition status on EUR-Lex and the Bundesgesetzblatt before use.
Phase 1: Initial Screening (1-2 days): rapid assessment to determine whether a vendor warrants detailed evaluation.
Phase 2: Detailed Assessment (1-2 weeks): comprehensive evaluation across all risk dimensions. See Section 2.
Phase 3: Final Evaluation (3-5 days): synthesis, risk scoring, mitigation strategies, recommendation.
test cases passed, vs 11 / 23 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.