A rating criterion for classifying vendor relationships by estimating potential impact of established risk factors, which may include data risk, concentration risk, resiliency risk, financial risk, or brand risk on an organization’s operations and objectives.