how do we conduct a third party risk assessment on our new software vendors without spending months on spreadsheets