Compliance-Focused Vendor Risk Assessment: Audit, Monitor, and Govern Third-Party Risk

A vendor risk assessment is a structured evaluation of the security controls, data handling practices, and compliance posture of your third-party vendors. Indian companies need one because regulators including RBI, SEBI, and NPCI now mandate that regulated entities formally assess and govern the risk introduced by their vendor ecosystem. Failure to do so can result in penalties, audit failures, and operational disruption.

TPRM, or Third-Party Risk Management, traditionally relies on questionnaires and document review — what the vendor says about their security. VRM, or Vendor Risk Management, adds continuous external monitoring to validate those claims against observable evidence such as exposed services, leaked credentials, and attack surface changes. Security Brigade's hybrid model combines both approaches for a complete picture.

For certain RBI-mandated audits, including System Audit Reports and Payment Aggregator audits, a CERT-In empanelled auditor is required. For board-driven or DPDP processor assessments, CERT-In empanelment is not legally mandatory but significantly strengthens the credibility and defensibility of the assessment report. Security Brigade is CERT-In empanelled.

A vendor risk assessment evaluates governance, compliance, data handling, contractual controls, and security posture across a vendor organization — not just technical vulnerabilities in a single application. It maps vendor controls to a regulatory framework and produces a compliance-grade deliverable. VAPT may be one component of the assessment but it is not the entire scope.

Yes. Most engagements are assessments of existing vendors, not just new-onboarding due diligence. Security Brigade assesses your current critical vendor ecosystem, identifies gaps, and provides a remediation roadmap. ShadowMap can then be used for continuous monitoring of those vendors going forward.

ShadowMap's VRM module continuously scans the external attack surface of every vendor in your ecosystem. It detects exposed services, leaked credentials, misconfigured cloud assets, expired certificates, and dark web mentions. This gives you evidence-based, always-on visibility into vendor risk that supplements periodic audit assessments.

RBI outsourcing directions require banks and NBFCs to audit technology vendors. SEBI CSCRF requires market intermediaries to assess vendor and cloud stacks. NPCI requires PSPs to audit TPAP systems annually. The DPDP Act requires data fiduciaries to validate processor security safeguards. Additionally, boards and risk committees increasingly mandate vendor risk governance as a best practice.

Pricing depends on the number of vendors assessed, the regulatory framework applied, the depth of technical testing required, and whether you choose the platform-only, service-only, or hybrid engagement model. Security Brigade provides a detailed scope and quote after an initial scoping call. Most engagements are priced per vendor or as a program-level fixed fee.

A single-vendor assessment typically takes one to two weeks depending on scope and vendor responsiveness. Multi-vendor programs are batched and run in parallel. ShadowMap VRM scans begin producing results within 24 hours of vendor onboarding. The Lemon platform tracks progress across all vendors in a single dashboard.

Yes. Security Brigade's assessment includes a review of fourth-party dependencies and sub-processor chains where they are relevant to your regulatory obligation. ShadowMap can also surface external exposure introduced by your vendors' own vendors, providing visibility into concentration risk and cascading dependencies.