Identification of Risks Related to Third Parties. Supplier shall identify the risks to its information and information assets from business processes involving third parties and then implement appropriate security controls. Supplier shall evaluate any information security risks posed by third parties prior to establishing a relationship with such third party. Once a relationship has been established, Supplier shall evaluate the third party’s information systems on a scheduled ongoing basis.
