When conducting a risk assessment for a vendor that provides multiple products, it is important to perform the assessment at the individual product level. Each product might have different risk factors, security requirements, and vulnerabilities, so assessing each one ensures a comprehensive understanding of the risks involved. Assessing randomly or only major products could leave gaps in understanding the risks for smaller but still critical products. CASP+ emphasizes that risk assessments should be detailed and product-specific for a thorough evaluation.
References:
* CASP+ CAS-004 Exam Objectives: Domain 1.0 - Risk Management (Vendor and Product Risk Assessments)
* CompTIA CASP+ Study Guide: Vendor Risk Management