Technical documentation needed for Procurement Punchout Security

Hi - We're working on adopting a Punchout Catalogue with several suppliers. Owing to the nature of our organisation, we need to understand various security aspects in order to get this change approved. Are you able to provide a white paper about Punch out and the security aspects of it? This would normally provide us suitable in how it designed and managed in a way that ensures customer information/systems are kept secure, and any threats/vulnerabilities managed. This could also include evidence of independent assurances including pen tests and other artefacts.
We have already looked in Cloud Customer connect and there is not any information about this. Similar questions on CCC are not answered. Our questions summarised below: