An information security team is planning a security assessment of an existing vendor. Which of the following approaches is MOST helpful for properly scoping the...