an organization that practices purchasing products from different vendors is demonstrating which security principle?