Tag third-party risk assessment