Third-party vendors that are required to comply with third-party risk management policies, processes, and practices.