Has your organization established security requirements for suppliers, products, and services based on their criticality level and potential impact?

This question assesses whether your organization has a structured approach to managing supply chain security risks by defining requirements proportional to the criticality of each supplier, product, or service. For example, a cloud provider hosting sensitive data would have more stringent security requirements than an office supply vendor. Similarly, critical software components would require more thorough security assessments than non-critical tools. Evidence could include a supplier security policy document, a tiered classification of suppliers with corresponding security requirements, security questionnaires tailored by criticality level, or contractual language templates that incorporate security requirements based on risk assessment outcomes.