During a risk assessment, a key external technology supplier refuses to provide control design and effectiveness information, citing confidentiality concerns. W...