[rman666]

See if they have a standard questionnaire. If not, propose the BITS AUP SIG (Google it) or the Vendor Security Alliance questionnaire (again, Google it). — VendorTrust.IO