What adverse impact data must the vendor provide? - What is your organization's threshold for acceptable adverse impact before deployment? - What monitoring commitments must the vendor make post-deployment?