What is a vendor risk taxonomy?

• A. A list of vendors sorted by alphabet.
• B. A structured classification scheme for vendors by risk type, criticality, data access, and system impact.
• C. A pricing model for services.
• D. A rubric for negotiating discounts.

Answer: (B)

A vendor risk taxonomy is a structured classification scheme for vendors by risk type, criticality, data access, and system impact. This framework lets an organization consistently categorize each vendor so that due diligence, contractual controls, and ongoing monitoring can be scaled according to risk. For example, a vendor handling highly sensitive data and essential operations would fall into a high-risk category, triggering deeper due diligence, stricter security requirements, and more frequent monitoring. In contrast, a vendor with minimal data access and low impact would be lower risk and require lighter oversight. The taxonomy provides consistency across the vendor portfolio and helps allocate resources, prioritize remediation, and align with regulatory expectations and risk appetite. Those other descriptions describe lists, pricing models, or discount rubrics, which do not support risk-based governance.