COVID-19 vendor risk considerations