An organization uses a third-party vendor that will have access to sensitive customer data. Which compliance best practice is MOST critical before engagement?

Remaining questions and full explanations are VIP-exclusive.