What are the implications when the companies that we turn to to mitigate our compromises is, itself compromised?  Does this influence your approach to the controls selection process?