A financial services firm acquires a pre-trained ML model from a third-party vendor for fraud detection. During onboarding, the security team discovers the vendor cannot provide documentation on the origin of the training dataset.
What should the CISO address FIRST?
A. Commission an independent bias audit before production deployment
B. Classify the model and its training data as high-value intellectual property
C. Assess whether the undocumented data sourcing introduces unmanageable supply chain risk
D. Require the vendor to retrain the model using only internally sourced datasets