A vendor has been awarded a contract to supply key business software.

Shift the negative impact of the risk to a cyber insurance provider, i.e., risk transference.

Document a risk acceptance, in accordance with internal risk management procedures, that will allow the product to go-live.

Gain assurance on the vendor's security controls by examining independent audit reports and any relevant certifications the vendor can provide.

Evaluate available open source threat intelligence pertaining to the vendor and their product.