Assessing third-party vendor risk: Top 6 challenges