Assign inherent risk tiers to vendors processing your data.
Formula fallback: Processing PII + Hosting in third country = High Risk.