Organizations should identify the kinds of suppliers (ICT, utilities, logistics, financial services, etc.) that can influence the confidentiality and accessibility of certain information. Organizations should evaluate suppliers with appropriate controls and security for information such as market research, customer information, document reviews, assessments, etc.