Which of the following is the BEST indication of mature third-party vendor risk management for an organization?

The BEST indication of mature third-party vendor risk management for an organization is that the

organization maintains vendor security assessment checklists. This is because vendor security

assessment checklists help the organization to evaluate and monitor the security posture and

performance of their third-party vendors, based on predefined criteria and standards. Vendor

security assessment checklists also help the organization to identify and mitigate any gaps or issues

in the vendor’s security controls or processes. The other options are not as indicative of mature

third-party vendor risk management for an organization, because they either involve following or

mimicking the security program of either party without considering their own needs or risks (A, D),

or relying on the vendor’s self-assessment without independent verification or validation C.