Refers to third parties that aren’t governed by your third-party risk management policies, processes, and practices.