An organization has a process in place that involves the use of a vendor. A risk assessment was completed
during the development of the process. A year after the implementation a monetary decision has been made to
use a different vendor. What, if anything, should occur?

A.
Nothing, since a risk assessment was completed during development.

B.
A vulnerability assessment should be conducted.

C.
A new risk assessment should be performed.

D.
The new vendor’s SAS 70 type II report should be reviewed.

Explanation:

The risk assessment process is continual and any changes to an established process should include a newrisk assessment. While a review of the SAS 70 report and a vulnerability assessment may be components of a risk assessment, neither would constitute sufficient due diligence on its own.