01
Risk assessments before engaging critical technology vendors
02
Due diligence on vendor financial condition, controls, security
03
Ongoing monitoring of vendor performance and security posture
04
Board and senior management oversight of third-party relationships