Vendor classification or risk tiering is a process of categorizing vendors based on the level of security risk they introduce to an organization12. It is a key component of a third-party risk management (TPRM) program, as it helps to prioritize and allocate resources for vendor assessment, monitoring, and remediation12. The statement D is true, as it reflects the first step of vendor classification or risk tiering, which is to determine the inherent risk of each vendor relationship based on the nature, scope, and complexity of the product or service being outsourced3 . Inherent risk is the risk that exists before any controls or mitigating factors are applied3 . By calculating the inherent risk, an organization can assign each vendor to a risk tier that reflects the potential impact and likelihood of a security breach or incident involving the vendor3 .

The other statements are false, as they do not accurately describe the vendor classification or risk tiering process. The statement A is false, as vendor classification and risk tiers are not based on residual risk calculations, but on inherent risk calculations. Residual risk is the risk that remains after controls or mitigating factors are applied3 . Residual risk is used to evaluate the effectiveness of the controls and the need for further action, but not to classify or tier vendors3 . The statement B is false, as vendor classification and risk tiering should be used for all third party relationships, not only for critical ones. Vendor classification and risk tiering helps to identify and prioritize the critical vendors, but also to manage the low and medium risk vendors according to their respective risk profiles12. The statement C is false, as vendor classification and corresponding risk tiers do not utilize the same due diligence standards for controls evaluation based upon policy, but different ones. Due diligence standards are the criteria and methods used to assess the security posture and performance of vendors. Due diligence standards should vary according to the risk tier of the vendor, as higher risk vendors require more rigorous and frequent evaluation than lower risk vendors.

References:

1: What is Vendor Tiering? Optimize Your Vendor Risk Management | UpGuard Blog

2: Vendor Tiering Best Practices: Categorizing Vendor Risks | UpGuard Blog

3: Third-Party Risk Management (TPRM): A Complete Guide - BlueVoyant

[4]: Supplemental Examination Procedures for Risk Management of Third-Party Relationships

[5]: Third Party Risk Management: Why It’s Important And What Features To Look For - Expert Insights