Which of the following four iterative steps are conducted on third-party vendors in an on-going basis?

Investigate is not a defined step in the NIST SP 800-39 risk management framework; it replaces 'Frame,' which is the correct first step that establishes the risk context and strategy.

NIST SP 800-39 establishes the four iterative steps of risk management as Frame (establish context and risk assumptions), Assess (identify and evaluate risks), Respond (develop and implement risk response strategies), and Monitor (continuously track risk over time). This framework is applied on an ongoing basis to third-party vendors to ensure continuous risk oversight throughout the vendor relationship lifecycle.

Remediate is not an official step in the NIST SP 800-39 framework; the correct third step is 'Respond,' which encompasses a broader set of actions including acceptance, avoidance, mitigation, and transfer of risk.

This option incorrectly combines 'Investigate' in place of 'Frame' and 'Remediate' in place of 'Respond,' neither of which are recognized steps in the NIST SP 800-39 iterative risk management process.