Information security is typically the critical early partner because vendor/processor risk assessment immediately turns on evaluatingtechnical and organizational measures(e.g., access controls, encryption, logging/monitoring, incident response capability, vulnerability management). Privacy needs security's input to validate whether safeguards appropriately protect personal data and to align privacy risk findings with the organization's security risk methodology and control environment. HR and auditors may be involved later, but InfoSec is foundational at the start.