> a company, after commissioning a security review, needs to hire a different firm to handle the vendor interactions These vendor interactions you're referring

> a company, after commissioning a security review, needs to hire a different firm to handle the vendor interactions These vendor interactions you're referring to are the company's customers, correct? Are you proposing the company hire another company to manage getting updates to their customers?