This is the second post in what will be a multi-part series that examines the question of how much rigour should be applied to ensuring a vendor’s security posture is adequate.