Vendor Cyber Loss Scenario Questionnaire

An editable 29-page handbook for the analyst who has to answer what a cyber event at a vendor would actually cost the business. The goal is not one exact number: it is a clear scenario, an evidence-based range, the assumptions and uncertainty on the page, and a decision an approver can sign.

What’s inside

• A seven-step method, from defining the decision and mapping the dependency to writing one connected scenario, building the loss range, challenging the result, and setting the monitoring and reassessment triggers
• Twenty-eight numbered items, VCL-01 to VCL-28, split into 21 Core checks for any material vendor and 7 Enhanced checks for concentration, regulated data, transaction power or difficult replacement
• Business Context and Dependency; Scenario Definition and Evidence; Availability and Operational Loss; and Data Privacy and Regulatory Loss
• Integrity Fraud and Financial Loss; Loss Estimation and Uncertainty; and Funding Contracts and Risk Decision
• A scenario statement template that forces cause, event, control condition, loss event, affected population and time period into one sentence
• Low-central-high estimation against every material category, with units, quantities, duration, source, owner and confidence, plus exclusions, double-counting risk, possible recoveries and residual loss
• A twelve-point final analyst checklist covering evidence, uncertainty, aggregation, insurance collectability and the approval record

This is a vendor-risk and business-impact assessment, not an actuarial forecast, an accounting opinion, an insurance-coverage opinion or a legal determination. Finance, Legal, Privacy, Insurance, Resilience and the business owners validate the assumptions that fall to them.