The program for assessing, monitoring, and governing risk introduced by vendors, suppliers, and other third parties.