Victoria wants to understand a potential vendor’s security practices. Which of the following is the simplest way for her to gather that information from multiple potential vendors?

Companies commonly send questionnaires to potential vendors to gather information about security practices prior to acquiring their products or engaging their services. This is a simpler method than requiring audits or penetration tests, and OSINT will not provide organizational answers about practices in most cases.