3: Vendor Security Measures