The point about subjecting your external vendor to the technical audit of their security services as well is a good one.