We consider our NGO base low-risk and follow our normal risk assessment procedures.
Depending on their final risk rating (based on products/services/etc) - depends on any EDD conducted.
I'll shoot you a PM
_________________________
My opinions are my own, and not that of my employer.