http://www.johnjasonfallows.com/2018/01/08/how-to-assess-a-vendors-data-security-3/