Procurement is not just a budget exercise: in modern IT buying, the vendor checklist can shape security posture long before any system goes live.