Assessment profiles (P1 / P2 / P3)
How the criticality profile sets questionnaire size and the impact weight in scoring.
What assessment profiles are
The profile (P1, P2, or P3) reflects how critical a supplier is to your business — how much an incident there affects your operations, your data, or your regulatory obligations. It decides two things: which controls from the pool go into the questionnaire sent to the supplier, and how much impact weight that supplier carries in the risk calculation.
The logic is cumulative. P2 answers everything P1 answers plus its own set; P3 answers all three levels. This matters when reading coverage: a P3's denominator is larger, not different.
Profile | Controls | Impact weight |
|---|---|---|
P1 — low criticality | 79 | 0.25 |
P2 — medium criticality | 201 | 0.50 |
P3 — high criticality | 257 | 0.75 |
P1 — low criticality
Receives the base questionnaire of 79 controls: 32 Cyber, 19 Privacy, and 28 Continuity. No AI controls — that pillar only starts at P2. These are suppliers with limited access to sensitive data, low operational impact in an incident, and a narrow contract scope. The 0.25 impact weight means that even with critical gaps, the potential business damage enters the calculation smaller.
P2 — medium criticality
Answers 201 controls cumulatively: 89 Cyber, 27 Privacy, 42 Continuity, and 43 AI. These are suppliers with access to personal data or internal systems, integration with critical processes, or a long-running contract with operational dependency. Impact weight 0.50.
P3 — high criticality
Answers the full pool of 257 controls: 107 Cyber, 34 Privacy, 50 Continuity, and 66 AI. These are suppliers whose unavailability or compromise interrupts an essential operation, or who process a meaningful volume of personal data on your behalf. Impact weight 0.75.
The weights are configurable
The 0.25 / 0.50 / 0.75 values are the methodology default, not a product constant. Each organization can adjust them under Settings › Methodology, and the change applies to subsequent calculations. If your entire portfolio is critical suppliers, compressing the scale may make more sense than inheriting the default spread.
About P0
There is a fourth profile, P0, reserved for hyperscalers — cloud providers and global platforms that do not answer a questionnaire because they do not answer customer questionnaires at all. They have no associated control pool, and in the risk calculation they carry the same impact weight as P3. Assessing them relies on public evidence and the certifications they publish, not on declared answers.