In vendor risk scoring, which factor is NOT commonly included?

• A. Data sensitivity.
• B. Access level.
• C. Regulatory exposure.
• D. Creative branding strategy.

Answer: (D)

Vendor risk scoring focuses on indicators that reflect how a vendor could impact data security, privacy, and regulatory compliance. When a vendor handles highly sensitive data, the potential damage from a breach is greater, so data sensitivity is a key factor in assigning risk. The level of access a vendor has to systems and data directly affects the potential for misuse or a security incident, making access level a core consideration. Regulatory exposure captures the risk of non-compliance with laws and industry requirements, which can lead to fines, penalties, or sanctions, so it’s another essential element.

Creative branding strategy, on the other hand, relates to marketing and image rather than the vendor’s risk posture in terms of security, privacy, or compliance. While reputational concerns can be relevant in broader risk discussions, it isn’t a standard driver of risk scores used to assess third-party risk. Therefore, branding strategy is not commonly included in vendor risk scoring.