Does your organization have a formal process to assess the cybersecurity capabilities and risk management practices of potential suppliers before engagement?

Supplier due diligence before engagement is what's being checked, specifically whether you assess a prospective vendor's cybersecurity capabilities and risk practices before signing on. A robust supplier assessment process should examine technical security controls, compliance certifications, incident response capabilities, and the supplier's own third-party risk management practices.

Evidence could include a documented supplier security assessment procedure, completed supplier security questionnaires, third-party security assessment reports, or a supplier risk register that shows security evaluations were conducted prior to engagement.