Looking at the current risk options we have for vendor management:

What is the logic if a vendor has sensitive data but the downtime doesn't matter at all?

As soon as a point is 'High', High must be selected or would a similar variant to the risk register be an idea?

For example: downtime and sensitive data are 2 separate points that are calculated into an overall risk level.