Your vendor questionnaire never asks who owns the company
Every third-party assessment I have seen asks the same three things. What data does the vendor touch. Where does it run. Who can reach our systems.
All good questions. And then it stops, and never asks the one that carries close to strict liability.