Does your organization conduct risk-based due diligence assessments on prospective suppliers prior to establishing business relationships?

This question evaluates whether your organization has a systematic process for evaluating potential suppliers based on the risk they may introduce to your business. Due diligence should include assessments of suppliers' security practices, financial stability, compliance history, and operational capabilities, with the depth of assessment proportional to the criticality of the supplier relationship and access to sensitive data or systems. Evidence of fulfillment could include a documented supplier due diligence policy, completed supplier risk assessment templates, security questionnaires sent to vendors, third-party risk management procedures, or reports showing supplier evaluation results with risk ratings.