Third-Party, Vendor and Supply Chain Risk Questions

Assessing and governing the security and privacy risk introduced by vendors, processors, sub-processors, and the broader supply chain. Covers vendor risk assessment and due diligence, data processing agreements and contractual security and privacy requirements, ongoing third-party monitoring, procurement compliance, and fourth-party risk. The 'trust but verify your dependencies' discipline across both security and data-protection obligations.