# OpenVMO risk-tiering rubric

OpenVMO v1.0 · Licence: CC BY 4.0 · https://vendorapp.co/openvmo/tiering/

Answer the five questions for each vendor. Each answer gives a tier. **The vendor's tier is the highest (most serious) tier any question produces.** Record all five answers in the register so the tier can be checked later (practice TIER-1).

| Question | Tier 1 if… | Tier 2 if… | Tier 3 if… |
| --- | --- | --- | --- |
| **Q1. What data can they see or hold?** | Customer production data, special-category personal data, or credentials and secrets | Employee personal data, or confidential internal data | Public data or none |
| **Q2. What access do they get?** | Admin, production, network, or API write access into core systems | Ordinary single sign-on users, or read-only integrations | None |
| **Q3. If they vanished tomorrow…** | Customers are affected within 24 hours, or we cannot operate | Internal disruption, with a workaround within a week | A mild inconvenience |
| **Q4. Are they customer-facing or in our product's data path?** | Yes, for example they are a subprocessor for our customers | (not used) | No |
| **Q5. Is there a regulatory flag?** | They support a critical or important function for a regulated customer, or they are our processor under GDPR Article 28 | (not used) | No |

## What each tier means

| Tier | Due diligence (DD-2) | Contract (CON-3) | Review cadence (MON-1) |
| --- | --- | --- | --- |
| 1 | Assurance report or standard questionnaire, reviewed and stored | Full OpenVMO clause set | Yearly, and on any event |
| 2 | Trust-centre or certificate check | Full OpenVMO clause set | Every two years |
| 3 | Baseline checks only (DD-1) | Standard terms are fine | At renewal |

## Sense check

At Series A, expect roughly 10% of vendors in Tier 1, 30% in Tier 2 and 60% in Tier 3. If more than a quarter of your vendors are Tier 1, the rubric is being applied too cautiously and the tiers will stop meaning anything.

Re-tier a vendor whenever its data, access or scope changes (TIER-2).