Risk Assessments

Basic Question

When you do assessment for any of the 3^rd party – are you doing assessment for the Product/Service rendered or for the complete 3^rd party ?

Typically, we are looking at things like financials and insurance from an enterprise lens but looking at Information Security/Cyber and BCP/DR from a product/ service lens.  For example, we are going to look at the company's financial statements, but we want to see the product specifically called out in SOC 2.