Which of the following actions should be included when conducting a vendor risk review?
A. Talk to the vendor's employees
B. Ask the vendor for a cost comparison
C. Test the vendor's hardware or software
D. Ask the vendor to fill out a security questionnaire