How businesses can vet their cybersecurity vendors