Has your organization established security requirements for suppliers, products, and services based on their criticality level and potential impact?

Risk-proportionate requirements are what's being examined, namely whether you set security expectations for suppliers, products, and services according to their criticality and potential impact. For example, a cloud provider hosting sensitive data would have more stringent security requirements than an office supply vendor. Similarly, critical software components would require more thorough security assessments than non-critical tools.

Evidence could include a supplier security policy document, a tiered classification of suppliers with corresponding security requirements, security questionnaires tailored by criticality level, or contractual language templates that incorporate security requirements based on risk assessment outcomes.