When entering into a third party vendor agreement for security services, at what point in the process is it BEST to understand and validate the security posture...