Tagged vendor-risk-management