What key steps encompass a third-party risk-management program? Option A 1. Create inventory of suppliers and vendors. 2. Determine which suppliers and vendors are critical. 3. Identify all third parties who have access to your data and systems. 4. Assign risk ratings to each third party. 5. Prioritize identifying alternatives to your critical suppliers. Option B 1. Conduct software code inventories. 2. Review the results of the software bill of materials. 3. Consider implementing a secure development standard that restricts use of open-source software. Option C 1. Establish the context. 2. Identify risk. 3. Analyze risk. 4. Evaluate risk. 5. Implement risk treatment and controls. 6. Monitor and review. Option D 1. Identify potential risks. 2. Assess their likelihood and impact. 3. Develop mitigation strategies. 4. Implement risk treatments. 5. Continuously improve process