Ask how the supplier manages a security breach, and ascertain whether they have a standardized and documented process in place. If your data is accessed without authorization, your supplier is required to notify you. Obtaining an ISAE 3000 statement ensures that this occurs because companies that receive an ISAE declaration establish processes that are periodically reviewed.