Before a company signs with a vendor, someone on the team has to answer questions about how much of the company's data that vendor will touch. The answers set the vendor's inherent risk rating. This is a rewrite of one real nine-question section: what each question is actually evaluating, which ones to keep, merge, or cut, consistent terms for the data involved, and a conversational version of the same flow.
The original questions come from publicly available help documentation for an enterprise third-party risk platform. I didn't write the original questionnaire. Thresholds and harm descriptions marked "draft" would need to be confirmed with risk and privacy subject matter experts.
Every person answering this section sees all nine questions, in this order, every time. Read as a respondent, six problems stand out.
Seven of nine are noun phrases, like "Third Party access to information through this engagement." The respondent has to work out what they're being asked.
A vendor with 4,000 records fits "<10,000", "<7,500", and "<5,000". Exactly 10,000 fits nothing. Two people can answer the same facts differently and get different scores.
"Customer, employee, partner information", "non-public personal information", "protected customer health records", "company or customer assets", and "intellectual property". The privacy side of the same platform calls it "PII".
"Importance and confidentiality of employee information" is rated High to Low with no description of what High means. The score depends on who's answering.
"Engagement", "third party", and "incidental access" are the system's terms. "Through this engagement" appears in eight of the nine questions.
A vendor that only sees employee records still gets five other questions, each answered "None".
The scoring rule is the key. If the vendor has no access to data, risk is Low. Otherwise, risk is the highest answer across Q4–Q9. Q2 and Q3 don't feed the score at all.
| Original | What it's evaluating | Used in score? | Decision |
|---|---|---|---|
| Q1 | Will the vendor touch our data at all? A "No" ends the assessment at Low. | Yes, as a gate | Rewrite, ask first |
| Q2 | Electronic or physical access | No | Cut, move to controls |
| Q3 | Do the vendor's own providers get access? (subcontractor exposure) | No | Rewrite, ask last |
| Q4 | Volume of customer personal information | Yes, 0–5 | Rewrite, fix ranges |
| Q5 | Volume of customer health information | Yes, 0–5 | Rewrite, fix ranges |
| Q6 | How much money or assets a breach could put at risk | Yes, 0–5 | Rewrite, add anchors |
| Q7–Q9 | Harm if employee information, partner information, or intellectual property got out | Yes, 0–5 each | Merge into one pattern |
| "None" × 6 | Whether each data type is involved | Scores 0 | Replace with one multi-select |
Three representative rewrites. Each keeps the original scoring values so the risk calculation doesn't change.
Means by which third party has access to customer, employee, partner information or company intellectual property through this engagement.
Will this vendor see or handle any of our data while doing the work?
Data includes information about customers, employees, or partners, and our intellectual property.
Why: It's now a question, and it comes first because "No" is the only answer that ends the assessment. "Incidental access" becomes a plain description of what it means.
Number of customer records containing Non-public personal information that third party has access to through this engagement.
About how many customer records could they see?
A rough estimate is fine. Customer personal information is anything about a customer that isn't public, such as account numbers, income, or Social Security numbers.
Why: The ranges no longer overlap, so every number has exactly one answer. "None" moves to the data type question. The regulatory term (nonpublic personal information) stays in the definition for reviewers who need it, but the label uses words a project lead would recognize.
Importance and confidentiality of employee information that the third party has access to through this engagement.
If the employee information they can see got out, how much harm would it cause?
Draft descriptions, to be confirmed with privacy and legal.
Why: "Importance and confidentiality" is really asking about impact. Describing each level gives two different people a fair chance of picking the same answer. One pattern covers employee information, partner information, and intellectual property, so respondents learn it once.
Some terms are set by regulation and can't change. The fix is to give each type one plain label in the interface and keep the regulatory term in the definition, where reviewers and auditors can find it. The table lists every label the questions use, including the ones that were already clear, so it can serve as the approved vocabulary for this section.
| Label in the questions | Original wording | Regulatory term kept in definition |
|---|---|---|
| Customer personal information | Non-public personal information; customer information; PII | Nonpublic personal information (GLBA); personal data (GDPR) |
| Customer health information | Protected customer health records | Protected health information (HIPAA) |
| Employee information | No change | Personal data (GDPR), where it applies |
| Partner information | No change | None |
| Our intellectual property | Company intellectual property | None. Examples given instead: designs, code, research, trade secrets |
| Money or assets they could move | Company or customer assets that could be diverted, stolen, or taken over | None |
| Vendor | Third party | Third party, in reports and the scoring documentation |
| This vendor's work for us | This engagement | Engagement, in reports and the scoring documentation |
Three questions anyone might see, and six follow-ups that only appear for the data types selected. Most respondents never see most of them.
Because the structure branches, it translates directly into a guided conversation. One question at a time, with the answer options as buttons, and a summary to confirm before submitting.
Five questions instead of nine. The score is the same one the original form would produce from the same facts: the highest answer is Significant (4), which is Medium-High.