19:I[71228,["4787","static/chunks/4787-36c5bed431f522c7.js","4724","static/chunks/4724-4c5cacb71c77f63f.js","2797","static/chunks/2797-17f1dad1d8dc07aa.js","3162","static/chunks/app/resources/articles/%5Bslug%5D/page-595ef71987f77771.js"],"default"] 1a:I[78432,["4787","static/chunks/4787-36c5bed431f522c7.js","4724","static/chunks/4724-4c5cacb71c77f63f.js","2797","static/chunks/2797-17f1dad1d8dc07aa.js","3162","static/chunks/app/resources/articles/%5Bslug%5D/page-595ef71987f77771.js"],"default"] 1b:I[98500,["4787","static/chunks/4787-36c5bed431f522c7.js","4724","static/chunks/4724-4c5cacb71c77f63f.js","2797","static/chunks/2797-17f1dad1d8dc07aa.js","3162","static/chunks/app/resources/articles/%5Bslug%5D/page-595ef71987f77771.js"],""] 1c:I[38437,["4787","static/chunks/4787-36c5bed431f522c7.js","4724","static/chunks/4724-4c5cacb71c77f63f.js","2797","static/chunks/2797-17f1dad1d8dc07aa.js","3162","static/chunks/app/resources/articles/%5Bslug%5D/page-595ef71987f77771.js"],"Image"] 1d:I[15402,["4787","static/chunks/4787-36c5bed431f522c7.js","4724","static/chunks/4724-4c5cacb71c77f63f.js","2797","static/chunks/2797-17f1dad1d8dc07aa.js","3162","static/chunks/app/resources/articles/%5Bslug%5D/page-595ef71987f77771.js"],"default"] 1e:T4c2,

🎯 THE SCENARIO

Your organization's vendor contracts include security requirements, but you discover that vendors are self-certifying compliance without independent verification. Audit resources are limited.

As a Cyber Risk Analyst with a limited security budget, you need to redesign your third-party vendor assurance program to effectively manage risk across 200+ vendors. Which approach would most efficiently allocate resources while maintaining appropriate oversight?

🟥 A. Apply risk-based tiering that assigns verification depth (self-attestation, audit review, or on-site assessment) according to vendor criticality and inherent risk.
🟦 B. Implement standardized security questionnaires for all vendors with periodic reviews triggered by contract renewal dates.
🟩 C. Focus verification efforts on vendors processing financial data while accepting ISO 27001 certification as sufficient assurance for all other vendor categories.
🟨 D. Require annual penetration testing reports from vendors based on the sensitivity of data they access and their integration level with your systems.