In the final step, Information Security Office (ISO) highlights the level of risk from the vendor by providing a "risk rating" and summarizing risk findings with security recommendations in a formal ...