A supplier has a valid certification but will process unusually sensitive data. What is the best next step?

1. Assess the relevant scope, controls and contractual obligations
2. Transfer all accountability to the supplier's auditor
3. Skip due diligence because all certifications have identical scope
4. Require the supplier to disclose every customer's records