A vendor has been awarded a contract to supply key business software.

Evaluate available open source threat intelligence pertaining to the vendor and their product.

Shift the negative impact of the risk to a cyber insurance provider, i.e., risk transference.

Gain assurance on the vendor’s security controls by examining independent audit reports and any relevant certifications the vendor can provide.

Document a risk acceptance, in accordance with internal risk management procedures, that will allow the product to go-live.