During a risk assessment, a key external technology supplier refuses to provide control design and effectiveness information, citing confidentiality concerns. What should the risk practitioner do…

Escalating non-cooperation to management is premature until it's confirmed that the supplier has a contractual obligation they are failing to meet.

Excluding applicable controls from the assessment would create a significant gap in the risk analysis and should only be considered as a last resort.

Before taking any further action, the risk practitioner must review the contractual agreement between the organization and the supplier to determine if the supplier is obligated to provide the requested control design and effectiveness information. This step clarifies whether the supplier is non-compliant with the contract or if such information sharing was never part of the agreement, informing subsequent actions.

Requesting risk acceptance before determining the supplier's obligations might prematurely accept an unknown risk and bypass potential contractual remedies.