# Third-Party Risk Assessment Scorer: Score Your Supplier and Subcontractor Exposure > Source: https://netray.co/tools/third-party-risk-assessment-scorer > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer Answer 8 questions on supplier due diligence, sub-tier visibility, concentration risk, and export control flowdown to score your third-party risk exposure. ## Category aerospace-defense ## Tool **Kind:** assessment **Questions:** #### How thorough is your due diligence when onboarding a new critical supplier or subcontractor? **Options:** ##### No formal due diligence process exists **Score:** 0 ##### Basic financial check only **Score:** 3 ##### Financial review plus quality certification check **Score:** 6 ##### Financial, quality, cybersecurity, and export control screening combined **Score:** 10 #### Do you require suppliers handling controlled or export-restricted data to flow down CMMC, ITAR, or export control clauses contractually? **Options:** ##### No, these clauses are not flowed down **Score:** 0 ##### Aware of the requirement, not consistently enforced **Score:** 4 ##### Enforced for direct tier-1 suppliers only **Score:** 7 ##### Enforced and verified across tier-1 and known sub-tier suppliers **Score:** 10 #### How do you monitor supplier financial health on an ongoing basis? **Options:** ##### Not monitored at all **Score:** 0 ##### Reactive only, after a problem has already surfaced **Score:** 4 ##### Periodic manual review, roughly annually **Score:** 7 ##### Continuous automated monitoring with alerting on material changes **Score:** 10 #### Do you have visibility into your suppliers' key subcontractors, sometimes called fourth-party risk? **Options:** ##### No visibility into sub-tier subcontractors **Score:** 0 ##### Aware of some sub-tier relationships, not documented **Score:** 4 ##### Documented for your most critical suppliers **Score:** 7 ##### Documented and monitored across the extended supply chain **Score:** 10 #### How concentrated is your spend or critical part sourcing with a single supplier? **Options:** ##### One supplier is sole source for critical parts with no contingency **Score:** 0 ##### Some concentration exists with informal awareness only **Score:** 4 ##### Concentration mapped with partial mitigation in place **Score:** 7 ##### Concentration mapped with qualified alternates for all critical items **Score:** 10 #### What is your process for tracking supplier security incidents or breaches that could affect you? **Options:** ##### No tracking process exists **Score:** 0 ##### Rely entirely on supplier self-reporting **Score:** 4 ##### Periodic security questionnaire refresh, roughly annually **Score:** 7 ##### Continuous monitoring plus contractual breach notification requirements **Score:** 10 #### How is supplier geographic and country-of-origin risk assessed for export control and sanctions compliance? **Options:** ##### Not assessed at all **Score:** 0 ##### Assessed once at onboarding only **Score:** 4 ##### Assessed at onboarding and reassessed on major supplier changes **Score:** 7 ##### Continuously screened against restricted party and sanctions lists **Score:** 10 #### Do you have a documented transition plan if a critical supplier fails or is terminated? **Options:** ##### No transition plan exists **Score:** 0 ##### Informal awareness only, nothing documented **Score:** 4 ##### Transition plan exists for some critical suppliers **Score:** 7 ##### Documented, tested transition plan for all critical suppliers **Score:** 10 **Bands:** #### High Exposure: Supply Chain Risk Is Largely Unmanaged **Min:** 0 **Max:** 40 **Verdict:** Your organization has minimal visibility into supplier financial health, sub-tier relationships, and export control compliance, leaving significant exposure that would concern any prime contractor or regulated customer conducting a supplier audit. This should be treated as an immediate priority given the contractual and compliance risk involved. **Recommendations:** - Build a documented due diligence checklist covering financial, quality, cyber, and export control screening - Map single-source dependency for every critical part within the next quarter - Begin flowing down CMMC, ITAR, or export control clauses to all applicable suppliers immediately - Establish a basic supplier incident tracking process, even if manual to start - Prioritize transition planning for your highest-risk single-source suppliers #### Developing: Direct Suppliers Covered, Sub-Tier Blind Spots Remain **Min:** 41 **Max:** 65 **Verdict:** You have reasonable due diligence and monitoring in place for direct tier-1 suppliers, but visibility into sub-tier subcontractors and continuous risk monitoring have meaningful gaps. This is a common and addressable state for most manufacturers, with the highest-value next step being sub-tier visibility. **Recommendations:** - Extend due diligence and clause flowdown verification to known sub-tier suppliers - Move supplier financial monitoring from periodic manual review to continuous automated tracking - Document transition plans for every supplier currently identified as single source - Formalize country-of-origin and sanctions screening as a recurring, not one-time, process #### Mature: Strong Coverage, Tighten Continuous Monitoring **Min:** 66 **Max:** 85 **Verdict:** Your third-party risk program covers due diligence, concentration risk, and export control flowdown well across your direct supply base. The remaining gap is typically shifting from periodic manual monitoring to continuous, automated tracking of financial health and security incidents. **Recommendations:** - Move to continuous automated monitoring for supplier financial health and security posture - Extend sub-tier visibility and monitoring beyond your most critical suppliers - Test your supplier transition plans at least once to validate they work under pressure - Formalize contractual breach notification requirements across your full supplier base #### Best-in-Class: Extend Governance Model as a Differentiator **Min:** 86 **Max:** 100 **Verdict:** Your third-party risk program demonstrates strong due diligence, continuous monitoring, sub-tier visibility, and tested transition planning. This level of maturity is a genuine differentiator in prime contractor and regulated customer qualification, and the priority now is maintaining it as your supply base evolves. **Recommendations:** - Use your third-party risk maturity as a qualification advantage with primes and regulated customers - Periodically reassess concentration risk as product mix and supplier relationships change - Share select risk visibility practices with critical suppliers to strengthen the extended chain - Automate evidence collection so supplier risk audits can be answered in hours, not weeks ## Content **Intro:** Third-party risk is rarely where organizations expect it: it is not the tier-1 supplier you scrutinize during onboarding, it is the sub-tier subcontractor two levels down that nobody has ever screened. This 8-question scorer evaluates your due diligence process, ongoing financial and security monitoring, sub-tier visibility, and export control flowdown, then places you in one of four risk bands with specific remediation steps. It is built for manufacturers, medical device makers, and defense suppliers who carry contractual and regulatory exposure for their entire supply chain, not just their direct suppliers. **Sections:** #### Sub-tier visibility is the gap that audits actually find **Body:** Most organizations have reasonably solid due diligence for the suppliers they contract with directly, but almost none have documented visibility into those suppliers' own critical subcontractors. When a prime contractor or regulated customer audits your supply chain risk program, sub-tier blind spots are consistently the finding that surfaces, because your direct suppliers rarely disclose their own dependency risk unless specifically required to. **Bullets:** - Fourth-party risk is frequently invisible until a disruption forces disclosure - Contractual flowdown requirements only work if you verify sub-tier compliance, not just require it - Prime contractor audits increasingly probe two or more tiers into the supply chain #### Concentration risk compounds quietly until it does not **Body:** A supplier that is comfortably within your top-20 spend list can still represent catastrophic concentration risk if it is the sole qualified source for a critical part, and this kind of risk tends to accumulate silently as product lines evolve and suppliers consolidate through acquisition. Mapping concentration risk requires looking at part criticality and qualification status, not just spend volume. **Bullets:** - Supplier consolidation through M&A can quietly create new single-source dependencies - Part criticality, not spend rank, is the right lens for concentration risk mapping - Qualified alternates take months to establish, so mapping needs to happen before a crisis #### Continuous monitoring beats periodic questionnaires **Body:** Annual security and financial health questionnaires capture a supplier's state at a single point in time, which means a material change six months after the last review goes undetected until the next cycle or an actual incident. Continuous monitoring services that track financial filings, security ratings, and sanctions list changes in near real time close this gap for a fraction of the cost of the risk they prevent. **Bullets:** - Point-in-time questionnaires miss changes that happen between review cycles - Continuous monitoring platforms can flag financial distress or security incidents within days - Automated sanctions and restricted party screening is now table stakes for defense supply chains **Cta:** Netray builds the AI-powered document processing and data pipelines that connect supplier risk data across ERP, procurement, and compliance systems, so sub-tier risk is visible before it becomes a disruption. **Faq:** #### What is fourth-party risk and why does it matter? **Answer:** Fourth-party risk refers to the risk introduced by your suppliers' own critical subcontractors, which sit two tiers removed from your organization and are typically invisible without direct engagement or contractual flowdown verification. It matters because a disruption or compliance failure at a fourth party can halt your production just as effectively as one at a direct supplier. #### How often should supplier risk be reassessed? **Answer:** Financial and security posture should ideally be monitored continuously rather than reassessed only annually, since material changes such as financial distress or a security incident can occur at any point in the cycle. At minimum, a formal reassessment should happen annually and immediately after any significant change in the relationship or the supplier's ownership. #### What does CMMC flowdown mean for suppliers? **Answer:** CMMC flowdown means that cybersecurity maturity model certification requirements applicable to a prime defense contract are contractually passed down to subcontractors handling Controlled Unclassified Information, obligating them to meet the same or an appropriate tier of security controls. Verifying flowdown compliance, not just requiring it contractually, is what closes the actual risk gap. #### How do you identify single-source concentration risk in a supply chain? **Answer:** Map every critical part or component against the number of qualified suppliers who can provide it, independent of current spend volume, since a low-spend item can still be single-sourced and critical. Parts with only one qualified source should be flagged for either alternate supplier qualification or documented safety stock as mitigation. #### What is the difference between periodic and continuous third-party risk monitoring? **Answer:** Periodic monitoring reassesses a supplier's financial and security posture at fixed intervals, typically annually, leaving a gap where material changes go undetected between reviews. Continuous monitoring uses automated data feeds on financial filings, security ratings, and sanctions lists to flag material changes in near real time as they occur. ## Search terms third-party risk assessment, supplier risk scorer, vendor risk management, sub-tier supplier risk, CMMC flowdown requirements, supply chain concentration risk, vendor due diligence checklist, defense supplier risk assessment --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json