Who is responsible for your infosec? Jaime Chanaga suggests you start a dialog with your vendors to find out