Vendor Information Risk Management BNY Mellon has a risk-based, centralized Vendor Information Risk Management (VIRM) program designed to address the adequacy of information risk practices of external third-party service providers.