https://securitystudio.com/4-musts-when-vetting-third-party-vendors/