Tag third-party vendor risk