As a Contract Manager, if you want to store a Vendor Risk Assessment (VRA), create a contract record; include Vendor Risk Assessment in the Contract Name, and upload the VRA document as the Main Document.

You can control access to the VRA contract record and Attachments using the settings in Users and Contacts on the contract record.  Refer to the Contracts Management “Contract Record Visibility” Quick Reference Guide for additional information.

You can also limit access to the VRA document by setting Contract Summary Visibility to Admin/Managers Only when you upload it.  Even if Full accss is granted using the Visibility Controls in Users and Contracts, only users with an Admin or Contract Manager Role will be able to access the document.