Vendor security assessment checklist