When assessing a new vendor as a possible business partner, what would BEST demonstrate that...

The vendor provides documented safeguards in handling confidential data.

The vendor provides a copy of their externally performed risk assessment.

The vendor has a Business Associate Agreement (BAA) in place before work begins.

The vendor has a signed contract in place before work with data begins.