Vendor and AI-Tool Risk Assessment Kit

Name: Vendor and AI-Tool Risk Assessment Kit
Brand: EdgeBefore
Price: 5999 INR

Your suppliers hold your data and your keys. When they fail, the legal duties stay with you. This kit gives you a proportionate way to know them, assess them and contract with them.

EdgeBefore Vendor and AI-Tool Risk Assessment Kit cover

Get the kit · ₹5,999 What’s inside

Under the DPDP Act, a Data Fiduciary stays responsible for processing done by its Data Processors, whatever the contract says. CERT-In’s reporting duty applies even when the affected data sits in a third party’s systems, and the six-hour clock can start the moment a vendor tells you. Meanwhile, recent attacks on MOVEit, XZ Utils, axios, tensorlake and LiteLLM show that the products and packages you install are suppliers too.

The Vendor and AI-Tool Risk Assessment Kit gives an Indian organisation a complete, right-sized programme: a register, a six-factor tiering method, sharp questionnaires, a scoring and decision method, a contract security schedule, and procedures for onboarding, monitoring, vendor incidents and exit. Every legal statement is cited to the official text.

What’s inside

Four files. One vendor process.

The Vendor Risk Guide: 72 pages

Why the law makes vendor risk your problem: DPDP Act and Rules, CERT-In Directions and FAQ, and sector rules
Building the register from the money, access and data trails, and tiering every vendor in minutes
Due diligence that reads evidence instead of filing it, and the eight security areas that matter most
Privacy review of vendors: processor or independent fiduciary, and whether a vendor can support erasure, rights requests and log retention
AI tool vendors: training on your content, retention, the model behind the product, and AI agents in your systems
Software supply chain: four lessons from real incidents and the controls they point to
Contract terms that matter, cloud and SaaS shared responsibility, scoring and formal risk acceptance
Onboarding, exit, ongoing monitoring, vendor incidents, concentration risk and fourth parties
A map of the RBI Master Direction on Outsourcing of IT Services (including its cloud appendix) for regulated entities and the companies that sell to them
A 90-day plan, common mistakes, FAQ, glossary and index

Templates (34 pages, 13 documents)

Vendor register with worked entry, tiering worksheet, core security questionnaire (full and short form), privacy and DPDP questionnaire, AI tool addendum, software component review, evidence and scoring sheet with decision record, risk acceptance, contract security and data schedule with gap map, onboarding and offboarding records, annual review form, vendor incident information request, and a vendor risk policy.

Checklists (11 pages)

New vendor gate, AI tool fast check, annual vendor review, vendor incident first hours, and vendor offboarding.

Quick card (1 page)

Tiering factors, what each tier needs, the eight security areas and the decision rules on one page.

All files are print-quality PDFs, current to 23 October 2026, delivered as one ZIP.

Who it’s for

For the people approving vendors.

Security, IT and compliance leads, procurement and legal teams, founders of growing companies, technology suppliers answering bank and NBFC questionnaires, and the advisers who support them.

Why teams use it

Proportionate. Tiering puts effort where the risk is. Low-risk vendors take minutes; critical ones get real scrutiny.
Evidence-led. Questionnaires are short and pointed, with guidance on reading assurance reports and spotting red flags.
Grounded in Indian law. DPDP, CERT-In and RBI requirements are cited to the official text and kept separate from EdgeBefore practice.
Joined up. Links to the EdgeBefore Breach Response Kit for incident reporting, the DPDP Starter Kit for processor clauses, and the AI Governance Pack for internal AI rules.

Price

One price. Everything included.

Vendor Risk Kit

₹5,999

The complete kit: guide, templates, checklists and quick card (PDF, delivered as one ZIP).
Instant download as a single ZIP, right on the page after payment

Final price in INR. Secure payment by Cashfree. Instant download: the page you land on right after payment has your download button.

Questions

Before you buy.

Is this legal advice?

No. The kit is general information to help you run a vendor risk programme. It is not legal advice and does not replace advice from a qualified advocate on your facts. No regulatory or other outcome is guaranteed.

Does it make us compliant with RBI’s outsourcing rules?

No kit can. The guide maps the main requirements of the Master Direction to the kit’s tools, but you must check the current text and how it applies to your entity.

We are small. Is this overkill?

No. The guide shows how a small organisation can run it with a register, the tiering worksheet, the new vendor gate and proper review of a handful of critical vendors.

Can we send the questionnaires to our vendors?

Yes. They are written to be sent with a short covering note and are licensed for that use by the purchasing organisation.

How current is it?

Current to 23 October 2026, including the DPDP Rules, 2025 and the October 2026 LiteLLM and tensorlake supply chain incidents.

What format are the files?

PDF: guide, templates, checklists and quick card, delivered as a single ZIP.

Can we share it across our organisation?

The kit is licensed for internal use by the purchasing organisation; templates may be adapted for that organisation’s own use and sent to its vendors.

EdgeBefore · General information, not legal advice. No outcome is guaranteed.