question 2 when evaluating the services of a vendor company, which of the following can be used to assess their security capabilities? check all that apply.