Need advice on developing a Risk Assessment methodology for assessing clients

I've been tasked with developing my companies cybersecurity risk assessment methodology for performing risk assessments for clients. I've read NIST 800-30 and understand the methodology it discusses, but it seems to me to geared towards internal assessments and not a third party doing the assessment. One suggestion was to use NIST CSF and do a gap assessment and then use those gaps as the risk register. I'm looking for advice/resources on how develop (from NIST 800-30) a third party risk …

advice assessment clients cybersecurity risk risk assessment