Chris is looking to procure a new CRM SaaS solution for his organization's business unit. What is the first step Chris should take as part of performing a risk assessment of a potential vendor? Determine the level of sensitivity of data that will be stored in the application. Ask reference clients about their satisfaction with the product. Obtain and review supplier documentation. Determine monthly costs