Supplier due diligence across nine security domains, with scoring, mitigation and annual reassessment