vendor risk reviews for soc2 - is this still mostly manual everywhere or does it get easier at scale?