Third-Party Risk Scorer

The score sums four risk dimensions. A higher total means higher risk. It is indicative and aligned with DORA Articles 28-30 and the RTS on subcontracting.

Dimensions

• Criticality — impact (10-40) + operational dependency (5-25) + substitutability (0-20).
• Security — data sensitivity (financial +15, personal +10, trade +12, operational +8) reduced by certifications (ISO 27001 -5, SOC 2 -5, ISO 22301 -3, PCI-DSS -3), floored at 0.
• Jurisdiction — provider location risk plus transfer safeguards (SCC -5, BCR -3, adequacy -4), floored at 0.
• Governance — a baseline of 30 reduced by contractual controls (SLA -8, audit right -6, exit plan -5, sub-contractor control -4, incident notification -5) plus a review-frequency factor.

Bands

• < 30 Low · 30-59 Medium · 60-89 High · ≥ 90 Critical.

Basis: DORA Art. 28 (TPRM), Art. 29 (concentration), Art. 30 (contractual provisions).