third-party vendor lifecycle