Can you walk me through a basic workflow for assessing vendor security posture during a third-party risk review