Phase 1 – third-party and architecture risk assessments