This is the first post in what will be a multi-part series that examines the question of how much rigour should be applied while ensuring a vendor’s security posture is adequate.