Vendor due diligence

Useful due diligence asks what this supplier will actually be able to reach, and what happens if they are compromised.

Most of it instead assesses the supplier in the abstract, at great length, with no reference to the specific access being granted. A small supplier with a connection into your network deserves more scrutiny than a large one processing nothing sensitive, and questionnaires rarely reflect that.