The role of a security professional in the vendor review process is to help identify which vendors are "critical" to the security of information assets.