1. Industry-Specific Risk Assessment: Additional risk assessment criteria specific to particular industries (e.g., healthcare, financial services)

2. Environmental Impact Assessment: Evaluation of environmental risks and sustainability practices, particularly relevant for providers with environmental impacts

3. Modern Slavery Assessment: Detailed assessment of modern slavery risks in the supply chain, required for larger organizations

4. Insurance Coverage Assessment: Detailed review of insurance policies and coverage levels, particularly important for high-risk services

5. Subcontractor Risk Assessment: Evaluation of risks associated with subcontractors, relevant when the provider uses substantial subcontracting

6. Technical Capability Assessment: Detailed evaluation of technical capabilities and systems, particularly relevant for IT service providers

1. Schedule A - Risk Assessment Criteria: Detailed criteria and scoring guidelines for each risk category

2. Schedule B - Required Documentation Checklist: List of required documents and certifications to be provided by the service provider

3. Schedule C - Risk Rating Matrix: Matrix showing how different risk factors combine to produce overall risk ratings

4. Schedule D - Control Assessment Framework: Detailed framework for assessing specific controls and their effectiveness

5. Appendix 1 - Industry-Specific Requirements: Specific requirements and considerations for different industries

6. Appendix 2 - Risk Assessment Questionnaire: Detailed questionnaire for gathering information from the service provider

7. Appendix 3 - Compliance Checklist: Checklist of regulatory and compliance requirements

8. Appendix 4 - Incident Response Templates: Templates for assessing incident response capabilities and procedures