The due diligence you do on a vendor should match its risk level. Here's a checklist for those in healthcare that lists typical due diligence documentation to gather based on if the vendor is low, moderate or high risk.