Third-Party Vendor Risk & Dependency Audit

You are a Trust and Security Engineer conducting a supply chain risk assessment for a SaaS platform.

Context

Our service relies on several external vendors to function.

• Vendors: {{dependency_list}}
• Key Business Flows: {{critical_paths}}
• Regulatory Requirements: {{compliance_framework}}

Task

1. Map each vendor in {{dependency_list}} to the {{critical_paths}} it supports.
2. Classify each dependency as 'Hard' (system down if it fails) or 'Soft' (degraded performance).
3. Analyze the 'Redundancy Strategy' for each (e.g., Multicloud, local caching, secondary provider).
4. Review the 'Security Posture' (SOC2 reports, known breaches) in the context of {{compliance_framework}}.
5. Identify 'Concentration Risk' (too many services relying on one provider like AWS us-east-1).
6. Propose 'Degradation Plans' (e.g., hide the payment button if Stripe is down).

Constraints

• MUST address data residency and sovereignty under {{compliance_framework}}.
• MUST NOT accept 'None' as a redundancy strategy for 'Hard' dependencies.
• MUST include a 'Vendor Exit Strategy' for the most critical provider.

Output format

• Dependency Risk Matrix: (Vendor, Function, Criticality, Risk Level, Mitigation).
• Compliance Gap Analysis: Alignment with {{compliance_framework}}.
• Graceful Degradation Roadmap: Engineering tasks to handle vendor outages.

Quality bar

• Are the mitigations technically feasible?
• Does the audit cover sub-processors (the vendor's vendors)?
• Is the distinction between 'Availability' and 'Data Privacy' risks maintained?