Why is third-party and supply chain security critical for trusted agents?

• A. Third-party risks can introduce vulnerabilities.
• B. Only price considerations matter.
• C. Due diligence and ongoing monitoring mitigate them.
• D. Once a partner is onboarded, monitoring is unnecessary.

Answer: (C)

Relying on trusted agents hinges on actively managing risks from external partners. Third-party and supply chain relationships can bring in vulnerabilities you don’t control directly—things like weak security practices, excessive access, or insecure software that become entry points for attackers. Because these risks can evolve as vendors change systems, personnel, or policies, you can’t just onboard and walk away.

That’s why the best approach is to conduct thorough due diligence and maintain ongoing monitoring. Due diligence helps you understand a partner’s security posture before you work with them—assessing their controls, data-handling practices, and compliance requirements, and embedding security expectations in contracts. Ongoing monitoring keeps you informed over time—watching for changes in their security controls, new vulnerabilities, access rights, incident history, and performance against commitments. This combination actively reduces risk rather than leaving you exposed to shifting threats.

Prices or the idea that monitoring isn’t needed after onboarding don’t address how risk persists and can change. By contrast, combining due diligence with continuous oversight directly mitigates the vulnerabilities third parties can introduce.