Several recent high-profile breaches in the company's sector entered through updates from trusted software suppliers. The organization's risk assessment currently covers only internally developed and hosted systems. What is the MOST appropriate response?
Select an answer to reveal the explanation.
Short Explanation
If the burglars are coming in through the delivery entrance, a risk review that only checks the front door has a blind spot. Your assessment scope has to include suppliers and the software they push to you. The trap is an overreaction like halting all patches, which swaps one risk for a bigger one.
Full Explanation
Risk assessment is only as good as its scope. When the threat landscape shows attackers using trusted suppliers as an entry point, the organization's assessment must include third-party and supply chain scenarios: which suppliers have privileged access or push code into the environment, how updates are validated, what contractual security obligations exist and how a compromised supplier would be detected and contained. That gives management a view of the exposure and supports proportionate treatment. Stopping all vendor updates creates a larger and more certain risk, because unpatched software is a well-known attack path, and on-site audits of every supplier are rarely practical. Requiring suppliers to carry insurance shifts part of the financial impact but does nothing to identify or reduce the exposure, and accountability remains with the organization. Replacing commercial software with in-house development is a costly strategic change that introduces its own development risk and ignores the open-source and component supply chain that internal code also depends on. Exam caveat: treatment comes after assessment; the question is about what the assessment must cover. Operational check: confirm the assessment methodology lists third parties and software suppliers in scope and that critical suppliers appear in the risk register.