Boards don't want your vendor list. They want to know whether third-party risk is trending up or down, and what you're doing about it.
The Four Metrics
- Critical vendor coverage — % of Tier 1 vendors with a current assessment.
- Time-to-detect — median hours between a vendor incident and internal awareness.
- Open remediation age — median days remediation items sit unresolved.
- Concentration risk — % of critical services delivered by any single vendor.
Track them quarterly. Show the trend line, not the snapshot.
