Due diligence is not a static, one-time event. It should be refreshed periodically, risk-based, and tailored to match the product or service provided by a third party along with the level of risk. Use this checklist to determine items you may want to gather based on if your vendor is classified as low, moderate, or high risk.