A vendor risk team of three people must assess the security of more than 600 suppliers, ranging from stationery vendors to cloud providers that hold customer data. What is the BEST approach?
Select an answer to reveal the explanation.
Short Explanation
You don't give a paper-clip supplier the same grilling as the company holding your customer data. Sorting vendors by risk lets you put your limited time where it matters. The trap is spend: a cheap contract can still hand over your crown jewels.
Full Explanation
Third-party risk management with limited resources depends on proportionality. Tiering suppliers by inherent risk, considering the sensitivity of data they access, their connectivity to systems and the criticality of the services they provide, lets the team apply thorough assessments to high-risk suppliers, lighter reviews to medium-risk ones and minimal checks to low-risk vendors. That concentrates scarce effort on the relationships that could cause the most harm. Sending the same detailed questionnaire to every supplier overwhelms a three-person team with responses it cannot review, burdens low-risk vendors unnecessarily and dilutes attention on critical providers. Working alphabetically until the budget runs out assigns priority by name rather than risk, leaving critical suppliers unassessed purely by chance. Using contract value as the only criterion is a common mistake, because spend does not reflect risk: an inexpensive software tool or service may have privileged access to sensitive data, while a large contract for physical goods may carry little information risk. Exam caveat: tiering should be revisited when the scope of a supplier relationship changes, since a low-risk vendor can become high risk with a new service. Operational check: confirm that every supplier in the inventory has an assigned tier with documented criteria and that assessment frequency and depth follow the tier.