What changed in high-risk classifications, documentation, and vendor due diligence—and how to align in 90 days.