An organization engages many different service providers. With limited resources, which of the following would be the BEST way to help ensure each service provider receives an appropriate risk…

The correct answer is B. Performing due diligence based on the relative risk of each service provider. Given limited resources, the most effective approach is to prioritize risk assessments based on the level of risk each service provider poses to the organization. High-risk providers (e.g., those handling sensitive data or critical operations) should receive more thorough…

Submitted by omar99· Apr 18, 2026Information Security Risk Management

Question

An organization engages many different service providers. With limited resources, which of the following would be the BEST way to help ensure each service provider receives an appropriate risk assessment?

Options

AReviewing independent assessments of each service provider
BPerforming due diligence based on the relative risk of each service provider
CAllowing process owners to conduct their own risk assessments of service providers
DRequiring each service provider to complete a self-assessment

How the community answered

(30 responses)

A
10% (3)
B
70% (21)
C
17% (5)
D
3% (1)

Explanation

Given limited resources, the most effective approach is to prioritize risk assessments based on the level of risk each service provider poses to the organization. High-risk providers (e.g., those handling sensitive data or critical operations) should receive more thorough evaluations, while lower-risk providers may undergo lighter assessments. This ensures that resources are allocated efficiently while maintaining appropriate security oversight.

Topics

#Third-party risk management#Vendor risk assessment#Due diligence#Risk-based approach

Community Discussion

No community discussion yet for this question.

Full CISM Practice