Which of the following BEST enables an enterprise to minimize the risks of intellectual property theft and loss of sensitive information when acquiring Internet of Things (IoT) hardware and software c

Reviewing data classification policy and documentation is an internal control, but it doesn't directly address the *external* risk introduced by third-party IoT components from the supply chain.

Terminating contracts with suppliers from sanctioned regions addresses geopolitical risks but is not a comprehensive cyber risk management strategy for all suppliers.

Requiring NDAs provides a legal protection layer but does not prevent the actual technical theft or loss of information if security vulnerabilities exist in the acquired components or the supplier's processes.

Integrating supply chain cyber risk management processes provides a holistic approach to evaluating the security posture of IoT suppliers and their components, from design to deployment and disposal. This includes assessing their security controls, compliance, and potential vulnerabilities, thereby reducing the risk of IP theft and sensitive data loss inherent in third-party components.