# Regulatory Standards — Vendor Risk Scoring

## Primary Regulations

### GDPR — Regulation (EU) 2016/679

- **Recital 76**: "The likelihood and severity of the risk to the rights and freedoms of the data subject should be determined by reference to the nature, scope, context and purposes of the processing. Risk should be evaluated on the basis of an objective assessment, by which it is established whether data processing operations involve a risk or a high risk."

- **Article 24(1)**: "Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation."

- **Article 28(1)**: Controllers must use only processors providing "sufficient guarantees." Risk scoring operationalizes this requirement by quantifying the guarantee level.

- **Article 32(1)**: Security measures must be implemented "taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons."

- **Article 35(1)**: DPIA required "where a type of processing... is likely to result in a high risk to the rights and freedoms of natural persons." Vendor risk scoring feeds into DPIA necessity assessments.

### EDPB Guidelines 07/2020 on Controller and Processor Concepts

- **Paragraph 86**: "In assessing whether a processor provides sufficient guarantees, the controller should take into account the processor's expert knowledge (e.g., technical expertise regarding security measures and data breaches), its reliability, and its resources."

- **Paragraph 87**: "Adherence to an approved code of conduct pursuant to Article 40 or an approved certification mechanism pursuant to Article 42 may be used as an element to demonstrate sufficient guarantees."

### ENISA Risk Assessment Framework

The European Union Agency for Cybersecurity (ENISA) provides risk assessment methodologies referenced in vendor risk scoring:
- Likelihood-impact matrix approach
- Asset-based risk identification
- Threat and vulnerability pairing
- Qualitative and quantitative scoring methods

### NIST SP 800-30 Rev. 1 — Guide for Conducting Risk Assessments

While a US framework, NIST 800-30 provides a widely-adopted methodology for structured risk assessment:
- Risk factor identification (threat sources, events, vulnerabilities, likelihood, impact)
- Semi-quantitative risk scoring (1-5 scales with defined criteria)
- Risk aggregation and communication
- Periodic risk reassessment

## Industry Frameworks

### ISO 27005:2022 — Information Security Risk Management

Provides the formal standard for information security risk assessment:
- Risk identification, analysis, and evaluation methodology
- Risk treatment options (modify, retain, avoid, share)
- Risk monitoring and review requirements
- Integration with ISO 27001 ISMS

### FAIR (Factor Analysis of Information Risk)

Quantitative risk analysis framework increasingly adopted for vendor risk:
- Decomposes risk into Loss Event Frequency and Loss Magnitude
- Enables comparison across vendor risk scenarios
- Supports quantified risk-based decision making

## Supervisory Authority Guidance

### French DPA (CNIL) — Risk-Based Processor Oversight (2022)

CNIL expects controllers to implement risk-based vendor management:
- Proportionate oversight aligned to processing risk
- Documented risk assessment methodology
- Regular risk reassessment
- Escalation procedures for increased risk

### Belgian DPA (APD) — Third-Party Risk Management Expectations

The APD has emphasized in decisions that:
- Generic risk assessments are insufficient — vendor-specific factors must be evaluated
- Risk scoring must consider both likelihood and impact on data subjects
- Controllers cannot rely solely on vendor self-reporting for risk classification