Study. uk . com
  1. Home
  2. All questions
  3. Question 490

CISM study material · question 490 of 1000

A team treats its initial due diligence questionnaire as the complete picture of supplier risk. What warning does NIST give?

  1. The initial due diligence risk assessment should not be treated as exhaustive
  2. Due diligence findings expire after thirty days and must then all be gathered again afresh
  3. Due diligence must always be performed by an independent third party rather than in-house
  4. Questionnaires are not an acceptable due diligence method and must be replaced by an on-site audit
Show the answer

Answer: A. The initial due diligence risk assessment should not be treated as exhaustive

SP 800-161r1 states enterprises should not treat the initial supply chain due diligence risk assessment as exhaustive, noting the results also shape the sourcing approach and refine requirements.

Source: NIST SP 800-161 Rev. 1 (NIST) — Sec. 3.1.2 The Role of C-SCRM in the Acquisition Process

Challenge yourself on this topic → Study as cards