Create the vendor profile, owners, and risk metadata.
Name, website, category, and lifecycle state
Internal accountability for reminders, escalation, and reporting
Security classification and operational exposure
Purpose, access notes, labels, and free-form context