Security and confidentiality posture
The first question is not technical, it is organisational: what happens to our artwork file, our recipient list and our delivery addresses when the job is finished. Banks ask whether files are stored on named-user accounts or on shared workshop drives, whether a supplier has any staff member with unsupervised access to client artwork, whether retention is defined, and whether unsold stock is destroyed on instruction rather than sold on. In practice the answers a bank needs are the specific ones: named accounts, least-privilege access, encryption in transit and at rest, a defined retention period, a documented disposal step, and a subcontractor list with the same confidentiality obligation attached to each name. A supplier that has a supplier-side information security policy answers all of these in one document. A supplier that does not answers them in conversation, and conversation is not what a tender file can hold. The second layer is physical: whether printed items and production samples can be photographed by anyone on the floor, and whether the packaging stage is segregated. The third is people: whether temporary staff used during a peak week are covered by the same confidentiality undertaking as permanent staff. That last point disqualifies more suppliers in banking than any technical control, and it is also the easiest one to fix and document.