Given this information, which of the following is a noted risk?

An organization’s assessment of a third-party, non-critical vendor reveals that the vendor does not have cybersecurity insurance and IT staff turnover is high. The organization uses the vendor to move customer office equipment from one service location to another. The vendor acquires customer data and access to the business via an API.

Given this information, which of the following is a noted risk?
A . Feature delay due to extended software development cycles
B . Financial liability from a vendor data breach
C . Technical impact to the API configuration
D . The possibility of the vendor’s business ceasing operations

Answer: B

Explanation:

Reference: https://legal.thomsonreuters.com/en/insights/articles/data-breach-liability