What describes risk-based due diligence in vendor assessment?

• A. Applying the same due diligence to all vendors regardless of risk.
• B. Tailoring the depth and scope of due diligence to the vendor's risk level.
• C. Completing due diligence only after a security incident.
• D. Relying solely on financial checks.

Answer: (B)

Risk-based due diligence focuses resources where risk is greatest. It means evaluating a vendor’s risk and adjusting the depth and scope of assessment accordingly—more scrutiny for vendors with access to sensitive data, critical systems, or high regulatory exposure, and lighter checks for lower‑risk relationships. This approach helps ensure important controls are verified, contractual remedies are in place, and ongoing monitoring matches the level of risk, while avoiding unnecessary work for low‑risk vendors. In contrast, applying the same level of due diligence to all vendors misses risk variation; waiting until after a security incident is too late; and relying solely on financial checks ignores security and operational risk.