Vendor and third-party

- Vendor security assessment process - Right to audit clauses - Vendor breach notification requirements - Open source maintainership and funding - Critical dependency risk concentration