Third-party vendor legal risk evaluation