List the typical stages of the vendor risk lifecycle.

• A. Identification, procurement, deployment, retirement.
• B. Vendor identification, due diligence, contracting/SLAs, onboarding, ongoing monitoring, reassessment, and offboarding.
• C. Sourcing, negotiation, onboarding, payment.
• D. Risk assessment, remediation, vendor renewal.

Answer: (B)

Understanding the vendor risk lifecycle means viewing vendor management as a continuous process that begins with spotting potential vendors and ends with securely closing the relationship. The stages usually include identifying vendors and the risks they bring; performing due diligence to assess security, privacy, regulatory compliance, and financial stability; formalizing the relationship through contracting and SLAs that set expectations, controls, incident response, and performance metrics; onboarding to integrate the vendor into your systems, align policies, grant appropriate access, and establish governance; ongoing monitoring to track performance, security posture, data handling, and compliance over time; reassessment to revisit risk posture at defined intervals or upon changes in scope, threat landscape, or contract, ensuring controls remain effective; and offboarding to securely terminate access, recover or destroy data, reclaim assets, and close the relationship with lessons learned. This sequence captures end-to-end risk management and keeps oversight active throughout the relationship, which is why it fits best compared with options that omit monitoring or offboarding, or focus only on internal procurement steps.