The vendor risk assessment process should consider due diligence factors such as distributed IT environments, legacy suppliers, and subcontractor use by the third party so that inherited operational and security risks are understood.