https://securitystudio.com/vendor-security-risk-simplify-standardize-and-defend/