Outsourcing remains an information security threat as many organizations are still not paying adequate attention to vendor risk management -- the process of assessing and mitigating risks, including due diligence and regular reviews of practices and procedures supporting vendors' products and services.