Mechanisms exist to conduct a risk assessment prior to the acquisition or outsourcing of technology-related services.