Regulators propose joint guidance on managing third-party risk