Additionally, suppliers may be subject to a security review, including requirements such as completion of an extensive security questionnaire; assessment of security capabilities and maturity; inspection of evidence of compliance with Cigna’s Security Policies; security alignment to service-specific industry standards, such as NIST, ISO, HIPAA, and Payment Card Industry standards, as appropriate; completion of application vulnerability assessments; site validation of attested controls from security questionnaires; and completion of a risk assessment.