vendor assessment cyber security posture rating