What role does third-party/vendor risk play in operational resilience?