Which action best reflects a POA program's approach to supply chain security?

• A. Increase marketing outreach to suppliers
• B. Assess supplier risk
• C. Centralize parking
• D. Reduce vendor audits

Answer: (B)

A POA program protects assets by actively managing risks across the supply chain, and the best action is to assess supplier risk because it provides the foundation for where controls are needed. By evaluating each supplier’s potential impact on security—what data or access they handle, their cybersecurity maturity, financial stability, regulatory considerations, and geographic factors—you create a risk profile that guides where to apply safeguards, how stringent contract requirements should be, and what ongoing monitoring is required. This approach lets you focus resources on the partners that pose the greatest risk and establish appropriate due diligence before onboarding and during the relationship, strengthening overall protection of assets.

Outreach to suppliers emphasizes relationship building rather than security controls; centralizing parking is unrelated to supply chain security; and reducing vendor audits decreases oversight and increases exposure to risk, which is contrary to a protective, risk-based approach.