Traditionally, supplier/vendor due diligence and third-party risk management (TPRM) resolves to the legal and compliance or financial management of a company or agency. When buying technology products, these folks often delegate cybersecurity approval – scans and reviews of information security documents – to technical personnel who are part of a different department, who run one-time scans or reviews, and are overburdened with other technical tasks.