we have a document we ask our vendors to fill out then our security, risk and project team meets with the vendor and their respective teams to go through in det

we have a document we ask our vendors to fill out then our security, risk and project team meets with the vendor and their respective teams to go through in detail and then we create a risk document for approval or workarounds where the vendor doesn't meet a requirement. Usually it's just like oh... you dont do this basic security... ok bye.