Does your organization have a formal process to assess the cybersecurity capabilities and risk management practices of potential suppliers before engagement?

This question evaluates whether your organization conducts due diligence on suppliers' security posture before establishing business relationships. A robust supplier assessment process should examine technical security controls, compliance certifications, incident response capabilities, and the supplier's own third-party risk management practices. Evidence could include a documented supplier security assessment procedure, completed supplier security questionnaires, third-party security assessment reports, or a supplier risk register that shows security evaluations were conducted prior to engagement.