Allegedly, there is a software vendor wishing to sell you goods and services. However that software vendor does not have any certifications proving they follow modern software security guidelines. Those goods and services could benefit 2 to 10 percent of your firm's employees. Assuming it has all the best features and is within your budget so that those arguments are mute, would you consider a purchase? would you consider a purchase if any current client agreements frown on un-audited software?