7 steps to protect against Vulnerable Third-party Service Providers