Allowing custom tags for all the list items (vendors, access, risks, etc) would make working with them much easier and flexible.
possible uses:
mark as WIP, missing DPA, asset type, assigned team, and much more