/tech-risk-assessment

name: tech-risk-assessment
description: >-
  Assess the security risk of a technology or product decision for leadership — new
  technology/vendor adoption, build-vs-buy, third-party/supply-chain, or M&A
  technical due diligence — and give a clear recommendation with trade-offs. Use to
  inform a strategic technology decision.

Goal

A decision-ready security risk assessment of the option(s) under consideration, with a recommendation that weighs security against velocity, cost, and strategic fit.

Steps

1. **Frame the decision** — what's being decided (adopt X / build vs. buy / acquire Y), the options, the data/systems involved, and the decision criteria. 2. **Assess each option's security posture:**

• **Build** — can we build and operate it securely? cost of doing so, our maturity.
• **Buy / adopt** — vendor security posture, certifications/attestations, data

handling and residency, integration and access scope, lock-in, and exit.

• **Third-party / supply-chain risk** — dependencies, provenance, and the blast

radius if the vendor/component is compromised.

• **M&A due diligence** — target's security posture, debt, incident history,

compliance exposure, and integration risk. 3. **Assess integration & data risk** — trust boundaries created, data exposure, identity/access, and the new attack surface (`threat-modeling`). 4. **Total cost incl. security** — build/operate/secure cost over time, not just license/sticker. 5. **Recommend** — a clear call with the risk trade-offs, required conditions/ mitigations, and residual risk stated honestly.

Output

A tech-risk assessment: decision · options · per-option security posture · third- party/integration/data risk · total cost incl. security · recommendation + conditions

• residual risk. Use `security-reporting`; diagram integration/trust boundaries with

`security-diagramming`.

Notes

Decide with explicit trade-offs, not security absolutism — the goal is the best risk-adjusted technology choice for the business. Weight third-party/supply-chain and exit/lock-in risk; they're routinely underestimated. State residual risk and the conditions under which the recommendation holds.