An information security risk assessment of a vendor s product should

review the organization s financial status.

validate their security practices.

review the security features.

be performed in a controlled lab environment.