When you give a vendor access, you inherit their security whether you like it or not. The spreadsheet-and-an-honest-hour fix for third-party risk.