Suppliers are risk assessed relative to what they do for you and how critical they are to you. You will assess that you have a current, in date contract, that includes the products and services you are buying. You will assess the level of assurance that you have that the supplier is doing the right thing for information security and this usually means that they have relevant in date certifications that cover the products and services that you are buying. You would use this third party risk assessment checklist and record it in the third party supplier register.