Conducting security assessments of critical service providers is an essential part of an enterprise risk management program.