Vendor Risk Attributes