Third-Party Risk Rating Readiness (IRIDX)
Your customers can now rate your information risk. Make sure the rating reflects what is really in place.
Already have an IT provider? Here's how we work together.
An example
A 25-person medical billing company in the Hudson Valley sells to three hospital systems. In January, the largest hospital tells its suppliers it now uses IRIDX to rate third-party information risk. Renewal terms will depend on the result.
The billing company has MFA, backups and a written security policy. But its proof is scattered: the policy is two years old, the backup test was never written down, and its last questionnaire answers were never checked against what is really in place. Its rating comes back with low evidence confidence. It looks riskier than it is, and the hospital asks for remediation before renewal.
The Problem
Launched by HITRUST on 2026-10-27 (HITRUST’s launch announcement), IRIDX gives enterprises, boards, insurers and regulators a standard way to rate a supplier’s residual information risk. It builds that rating from the evidence a supplier already has: assessments, certifications, questionnaires and outside signals. It separates two things:
- Control weaknesses: something is not in place.
- Evidence gaps: something may be in place, but the proof is thin, old or missing.
Most small suppliers have more of the second than the first. Each gap costs them on a rating their customers now see, and the same rating can shape contract terms and insurance.
More on what moves the score: Your customers can now rate your information risk. Here’s what moves the score. on the SMC Blog.
What we do
The same three steps we already offer, aimed at the rating your customer uses.
| Step | What the supplier gets | Price |
|---|---|---|
| 1. Free assessment | A free assessment answered online, then a gap report and a free results review (an optional free 30-minute call can come first). It shows where controls or evidence are likely to pull a rating down. | Free |
| 2. Paid assessment, scoped | One or two named standards, chosen for what the customer asks about, for example NIST CSF 2.0, the HIPAA Security Rule met through NIST SP 800-53, or SOC 2 criteria. Each area gets a maturity level, the evidence that exists and the evidence that is missing, and a prioritized plan. | Per proposal |
| 3. Pre-audit preparation | Evidence verification: we check the proof behind each claimed level, organize it into an evidence register, and retest in rounds until it holds up. Where a formal audit or certification is the goal (SOC 2, HITRUST, ISO 27001), the same evidence carries forward. | Per proposal |
Every paid engagement starts with a detailed plan that has time estimates, built from your people, deadlines and circumstances. For how preparation rounds work, see Audit Preparation.
Who does what
- Security Medic: assesses, sets levels, verifies evidence, builds the register and plan, and runs mock reviews.
- The supplier: owns its controls and evidence, and decides what to share with its customers and with IRIDX.
- The customer and IRIDX: produce the rating. We do not produce, change or guarantee a rating.
Security Medic is independent and claims no affiliation with HITRUST or IRIDX.
Start with the free assessment
Answer it online. The gap report shows where controls or evidence are likely to pull a rating down.
Take the free assessment