Vendor Security Review Tracker Template
Two documents and three sheets that price every open blocker by deal value per engineering hour, then rank it against your own roadmap.
Free download · No account needed
Deal Value At Risk · security review register
One hour of engineering time here outranks the roadmap's own top commitment by 81 times.
| Blocker | Eng hours | $ per eng hour | x roadmap rate |
|---|---|---|---|
| Sundale Municipal Services | 1 | $72,000 | 81.0x |
| Oakhurst Retail Group | 6 | $56,667 | 63.7x |
| Roadmap benchmark, Q3 initiative | 720 | $889 | 1.0x |
The Sundale blocker is one missing line in a document. The roadmap commitment is a quarter of three engineers' time. Priced the same way, the missing line wins.
$836,000 behind 30 hours
Five internal blockers, $836,000 of ACV combined, clear in thirty engineering hours: under one person's week, split across three owners.
Every vendor selling into security reviews sells the same fix: draft the next questionnaire faster, cite a document on each answer, assign an owner, track a status. That work matters, and the security questionnaire response pack is built around it. None of them price the thing that actually stalls a deal, though, which is rarely the buyer. It is one unanswered item sitting in one engineer's queue, next to a sprint that already has a number attached to it, and a day count never wins that argument.
So this tracker prices every blocker the way the roadmap already prices its own backlog: the deal's ACV divided by the engineering hours the fix actually needs. That is a cost-of-delay-over-job-duration ratio, the same logic the Scaled Agile Framework's WSJF formula uses to sequence work. In the worked example below, a one-hour fix behind a $72,000 deal prices at $72,000 an hour, eighty-one times the rate of the company's own named roadmap commitment. Five blockers worth $836,000 combined clear in thirty engineering hours, under one person's week.
Not every blocker has an engineering-hours dial to turn. A pen test booked through an outside vendor needs a minimum lead time no amount of internal urgency compresses. So the register tags it vendor-bound and routes it to a different action: expedite the vendor, or reset the buyer's expected date before the target close date arrives unannounced. The documents a resolved blocker eventually becomes evidence inside sit in the trust package.
What's in the pack
Price the Blocker, Not Just Its Age
The method itself: deal ACV divided by the engineering hours a fix actually needs, expressed as a multiple of what your own roadmap already earns per hour.
Review Register sheet
Every deal currently in security review, its blocking item, its owner, and how many days it has sat open against its target close date.
Blocker Log by Owner sheet
Every internal blocker priced in dollars per engineering hour, its multiple of the roadmap rate, and whether it has crossed the SLA breach threshold.
Deal Value At Risk sheet
The ranked view: highest-priced blockers first, a running cumulative ACV total, and every vendor-bound item called out separately at the foot.
Process Definition
How a row moves from open to priced to escalated to resolved, and the job-type split that decides whether pricing can move a blocker at all.
SLA with Internal Teams
The actual response commitment once a blocker crosses the breach threshold, and the separate path for anything waiting on an outside party. A blocker that turns out to be a real capability gap rather than a queued question becomes a different job, the security objection and gap brief's, not another week in this queue.
How to use it
- 1
Open in River, or take it blank
Open the pack in River and hand it your open deals, or download the Word documents and CSV sheets and fill them in yourself.
- 2
Load every deal in active review
Account, ACV, when the review opened, the target close date, and the specific item each one is blocked on, with who owns it.
- 3
Type the job, then price it
Internal blockers get priced in dollars per engineering hour against a named roadmap commitment. Vendor-bound ones get a realistic date instead.
- 4
Escalate what's overdue, reroute what isn't fixable internally
The breached rows get the escalation with the priced multiple attached. The vendor-bound rows get a note to the deal owner instead of an SLA clock.
Frequently asked questions
Is this template free?
Yes. Two Word documents and three CSV sheets, downloaded as a zip, no signup. River is the optional half: it reads your open deals, prices every blocker, and drafts the escalation for anything past its threshold. The rest of the packs sit in the template library, and single-output jobs in the tool index.
How is this different from a security questionnaire tracker or an answer bank?
Those own a different problem. The security questionnaire response pack answers the buyer's actual sheet, and the answer bank build turns your history into reusable answers. This tracker starts once a specific internal item is already blocking a specific deal, and prices that item against your own roadmap so it gets an engineer's time.
Where does the engineering-hours estimate come from?
From the owning engineer, not from the deal size or how complicated the question sounds. A guessed hour count produces a price that looks precise and is not, and the first time an owner disputes it the whole ranking loses credibility. An unscoped blocker stays unpriced rather than getting a made-up number.
What if we don't have a roadmap benchmark rate to compare against?
Use the most recent quarter's largest funded initiative: its own dollar figure and the engineering hours staffed against it. Say plainly that this is what was used, so it can be corrected later. A real, named commitment works better than an abstract average, because the reader you are convincing already reasons in specific initiatives.
Why exclude vendor-bound blockers from the priced ranking?
Because pricing only moves work with an engineering-hours dial to turn. A pen test booked through an outside firm needs a minimum calendar lead time no internal urgency compresses, so ranking it against internal blockers just teaches everyone to ignore the next alert. It gets a different action: expedite the vendor, or reset the buyer's expected date.
Does this replace our ticketing system?
No. Whatever tickets already get worked in, Jira, Linear or otherwise, stays exactly where it is. This is the pricing layer on top: which of those tickets is actually worth an engineer's afternoon today, in the same dollars-per-hour terms the roadmap is already prioritised by.
Find out what an hour of engineering time is actually worth today
Take the Word documents and CSV sheets blank, or open this exact pack in River and let it price your open reviews first.
Edit with AI