What role does 'vendor due diligence' play in TA risk management?

• A. Recommends outsourcing all security controls to vendors.
• B. Evaluates supplier security posture, controls, and reliability to prevent third-party risk.
• C. Is not concerned with vendors as long as internal controls exist.
• D. Only checks vendor financial stability.

Answer: (B)

Vendor due diligence centers on evaluating how a supplier handles security and operations to prevent risks from third parties. It involves assessing the supplier’s security posture, controls, governance, and reliability—looking at how they protect data, manage access, patch vulnerabilities, respond to incidents, and ensure business continuity. By performing this evaluation before onboarding and as part of ongoing oversight, you can decide whether the vendor can meet your security requirements, set concrete contractual obligations, and continuously monitor for changes that could raise risk. This is how you reduce third-party risk and avoid the vendor becoming a weak link in your TA environment. Financial stability matters for continuity, but the main focus here is ensuring the vendor’s security practices and reliability align with your risk standards. It’s not about outsourcing all controls, and it’s not appropriate to ignore vendors or limit the review to finances alone.