“We needed a tool that provided us with a more prescriptive, riskbased analysis for each vendor we worked with."
"We don’t look at just what’s the risk, but also what’s the impact."