Does your due diligence process include assessing your vendor's cybersecurity posture? Have you identified the risks and applied controls to mitigate the risk? And if something goes wrong, what happens next?