Vetting Third-Party Vendors