how do i start a third party risk assessment program for our vendors when i am the only IT person here