External Assessment Review Procedure Superseded by the Vendor Security Review Standard on April 28, 2020