CTPRP Certified Third-Party Risk Professional (CTPRP) Questions and Answers

 According to the CTPRP Job Guide, the TPRM program should establish minimum risk assessment standards for third party due diligence based on the company’s risk tolerance and risk appetite. This means that the TPRM program should define the scope, depth, frequency, and methodology of the risk assessment process for different categories of third parties, taking into account the potential impact and likelihood of various risks. The risk assessment standards should be consistent, transparent, and aligned with the company’s strategic objectives and regulatory obligations. The TPRM program should also monitor and update the risk assessment standards as needed to reflect changes in the business environment, risk profile, and best practices. The other options are not correct because they do not reflect a holistic and risk-based approach to third party due diligence. Setting the standards by each business unit may result in inconsistency, duplication, or gaps in the risk assessment process. Defining the standards in the contract or statement of work may limit the flexibility and adaptability of the risk assessment process to changing circumstances. Identifying the standards by procurement may overlook the input and involvement of other stakeholders and functions in the risk assessment process. References:

• CTPRP Job Guide, page 17
• Third-Party Risk Management and ISO Requirements for 2022, section “Benefits of Implementing Risk Management”
• Managing third-party risk through effective due diligence, section “Complying with regulators’ demands”
• Third-Party Due Diligence Checklist: 3 Essential Steps, section “Step 2: Conduct a Risk Assessment”

Vendor inventory is a list of all the third-party vendors that an organization engages with, along with relevant information about their products, services, contracts, and risks. Vendor inventory is a crucial tool for vendor risk management, as it helps an organization identify, assess, monitor, and mitigate the potential risks associated with its vendors. Vendor inventory also helps an organization prioritize its vendor oversight activities, allocate its resources efficiently, and comply with its regulatory obligations12.

One of the key steps in creating and maintaining a vendor inventory is to assign a risk rating and a vendor classification to each vendor, based on various attributes that reflect the level of risk and criticality they pose to the organization. The risk rating and vendor classification help an organization determine the frequency and depth of its vendor due diligence, review, and audit processes, as well as the appropriate controls and remediation actions to implement3 .

Some of the common attributes used to assign risk rating and vendor classification are :

• Type of data accessed, processed, or retained: This attribute indicates the sensitivity and confidentiality of the data that the vendor handles on behalf of the organization, such as personally identifiable information (PII), protected health information (PHI), financial information, intellectual property, etc. The more sensitive and confidential the data, the higher the risk rating and vendor classification, as the vendor must comply with strict security and privacy standards and regulations, and the organization must protect itself from data breaches, leaks, or losses.
• Type of systems accessed: This attribute indicates the access level and privileges that the vendor has to the organization’s systems, such as networks, servers, databases, applications, etc. The more access and privileges the vendor has, the higher the risk rating and vendor classification, as the vendor must adhere to the organization’s policies and procedures, and the organization must safeguard itself from unauthorized or malicious activities, such as cyberattacks, sabotage, or espionage.
• Type of network connectivity: This attribute indicates the mode and frequency of the data transmission and communication between the vendor and the organization, such as online, offline, real-time, batch, etc. The more network connectivity the vendor has, the higher the risk rating and vendor classification, as the vendor must ensure the availability, integrity, and reliability of the data, and the organization must prevent data interception, modification, or disruption.

The type of contract addendum is NOT an attribute used to assign risk rating and vendor classification, as it is not directly related to the risk or criticality of the vendor. The type of contract addendum is a legal document that modifies or supplements the original contract between the vendor and the organization, such as adding or deleting terms, clauses, or provisions. The type of contract addendum may reflect the changes or updates in the vendor relationship, such as scope, duration, price, service level, etc., but it does not indicate the level of risk or impact that the vendor has on the organization. Therefore, the type of contract addendum is not a relevant factor for vendor risk assessment and management . References:

• 1: Vendor Inventory - Shared Assessments
• 2: Vendor Inventory Management: A Guide to Third-Party Risk Management
• 3: Vendor Risk Rating - Shared Assessments
• : [Vendor Risk Rating: How to Rate Your Vendors | Smartsheet]
• : [Vendor Classification - Shared Assessments]
• : [Vendor Tiering: How to Classify Your Vendors | Smartsheet]
• : Contract Addendum - Shared Assessments
• : What is a Contract Addendum? | Definition and Examples | Imperva

The Cardholder Data Environment (CDE) is the part of the network that stores, processes, or transmits cardholder data or sensitive authentication data, as well as any connected or security-impacting systems123. The CDE is subject to the Payment Card Industry Data Security Standard (PCI DSS), which is a set of requirements and guidelines for ensuring the security and compliance of payment card transactions123. The PCI DSS defines various artifacts that are reviewed when assessing the CDE, such as:

• The Data Security Standards (DSS) framework: This is the document that specifies the 12 high-level requirements and the corresponding sub-requirements and testing procedures for PCI DSS compliance123. The DSS framework should be used to scope the assessment, meaning to identify and document the systems and components that are in scope for PCI DSS, as well as the applicable requirements and controls for each system and component123. Therefore, option A is a true statement regarding artifacts reviewed when assessing the CDE.
• The Report on Compliance (ROC): This is the report that provides the assessment results completed by a qualified security assessor (QSA) that includes an onsite audit of the CDE123. The ROC is a detailed and comprehensive document that validates the organization’s compliance status and identifies any gaps or deficiencies that need to be remediated123. The ROC is required for merchants and service providers that process more than 6 million transactions annually, or that have suffered a breach or been compromised in the past year123. Therefore, option B is a true statement regarding artifacts reviewed when assessing the CDE.
• The Self-Assessment Questionnaire (SAQ): This is a questionnaire that provides a validation tool for merchants and service providers that are not required to submit a ROC123. The SAQ is a self-assessment tool that allows the organization to evaluate its own compliance status and identify any gaps or deficiencies that need to be remediated123. The SAQ does not provide independent testing of controls, as it is based on the organization’s self-reported answers and evidence123. Therefore, option C is a false statement regarding artifacts reviewed when assessing the CDE.
• A System and Organization Controls (SOC) report: This is a report that provides an independent audit of the internal controls and processes of a service organization, such as a cloud provider, a data center, or a payment processor45. The SOC report is not specific to PCI DSS, but rather to other standards and frameworks, such as SOC 1 (based on SSAE 18), SOC 2 (based on Trust Services Criteria), or SOC 3 (based on SOC 2)45. A SOC report is not sufficient to demonstrate PCI DSS compliance, as it may not cover all the requirements and controls of the PCI DSS, or it may not address the same location or scope as the CDE123. Therefore, option D is a false statement regarding artifacts reviewed when assessing the CDE.

References: The following resources support the verified answer and explanation:

• 1: PCI DSS Quick Reference Guide
• 2: PCI DSS FAQs
• 3: PCI DSS Glossary
• 4: What is a SOC report?
• 5: SOC Reports: What They Are, and Why They Matter

An Information Security Incident Management Program is a set of policies, procedures, and tools that enable an organization to prevent, detect, respond to, and recover from information security incidents. An information security incident is any event that compromises the confidentiality, integrity, or availability of information assets, systems, or services12. A formal Information Security Incident Management Program typically includes the following components12:

• The definition of internal escalation processes: This component defines the roles and responsibilities, communication channels, and reporting mechanisms for escalating and managing information security incidents within the organization. It also establishes the criteria and thresholds for determining the severity and impact of incidents, and the appropriate level of response and escalation.
• The protocols for disclosure of information to external parties: This component defines the rules and guidelines for disclosing information about information security incidents to external stakeholders, such as customers, regulators, law enforcement, media, or other third parties. It also specifies the legal and contractual obligations, the timing and frequency, the format and content, and the approval and authorization processes for disclosure.
• The mechanisms for notification to clients: This component defines the methods and procedures for notifying clients or customers who may be affected by information security incidents. It also specifies the objectives, scope, and content of notification, as well as the timing and frequency, the delivery channels, and the feedback and follow-up mechanisms.
• The processes in support of disaster recovery: This component defines the steps and actions for restoring the normal operations of the organization after a major information security incident that causes significant disruption or damage to the information assets, systems, or services. It also specifies the roles and responsibilities, the resources and tools, the backup and recovery plans, and the testing and validation procedures for disaster recovery.

The statement that reflects a requirement that is NOT typically found in a formal Information Security Incident Management Program is D. The program includes processes in support of disaster recovery. While disaster recovery is an important aspect of information security, it is not a specific component of an Information Security Incident Management Program. Rather, it is a separate program that covers the broader scope of business continuity and resilience, and may involve other types of disasters besides information security incidents, such as natural disasters, power outages, or pandemics3 . Therefore, the correct answer is D. The program includes processes in support of disaster recovery. References: 1: Computer Security Incident Handling Guide 2: Develop and Implement a Security Incident Management Program 3: Business Continuity Management vs Disaster Recovery : What is the difference between disaster recovery and security incident response?

Fourth-Nth party risk refers to the potential threats and vulnerabilities associated with the subcontractors, vendors, or service providers of an organization’s direct third-party partners12. After contract signing and on-boarding due diligence is complete, the most important type of contract provision to manage Fourth-Nth party risk is subcontractor notice and approval. This provision requires the third party to inform the organization of any subcontracting arrangements and obtain the organization’s consent before engaging any Fourth-Nth parties345. This provision enables the organization to have visibility and control over the extended network of suppliers and service providers, and to assess the potential risks and impacts of any outsourcing decisions. Subcontractor notice and approval also helps the organization to ensure that the Fourth-Nth parties comply with the same standards and expectations as the third party, and to hold the third party accountable for the performance and security of the Fourth-Nth parties345. References:

• 1: Understanding 4th- and Nth-Party Risk: What Do You Need to Know? | Mitratech
• 2: Understanding 4th- and Nth-Party Risk: What Do You Need to Know? | Mitratech Holdings, Inc - JDSupra
• 3: First, 2nd , 3rd , 4th, 5th Parties: How to Measure the Tiers of Risk
• 4: Managing 4th Party Risk with Vendor Insurance Verification - Evident ID
• 5: How to Write Fourth-Party Vendor Requirements Into the Contract - Venminder

Termination for cause is the type of contract termination that is most likely to occur after failure to remediate assessment findings. This is because termination for cause is based on a breach of contract by the third-party, such as non-compliance, poor performance, fraud, or misconduct. Failure to remediate assessment findings indicates that the third-party has not met the contractual obligations or expectations of the entity, and thus exposes the entity to increased risk and liability. Termination for cause allows the entity to end the contract immediately or after a notice period, and to seek damages or remedies from the third-party. Termination for cause is different from other types of contract termination, such as:

• Regulatory/supervisory termination, which is triggered by a change in law or regulation that affects the legality or feasibility of the contract.
• Termination for convenience, which is exercised by the entity without any fault or breach by the third-party, usually for strategic or operational reasons.
• Normal termination, which is the natural expiration of the contract term or the completion of the contract scope. References:
• Shared Assessments. (2020). Certified Third Party Risk Professional (CTPRP) Study Guide1
• Fusion Risk Management. (2021). Exit Strategy for Terminating a Third Party2
• Volkov, M. (2016). Third-Party Risk Management – Part 2: Contract Termination3

Data privacy policies are documents that outline how an organization collects, uses, stores, shares, and protects personal information from its customers, employees, partners, and other stakeholders1. Data privacy policies should address the following key elements2:

• The purpose and scope of data collection and processing
• The legal basis and consent mechanism for data processing
• The types and categories of personal data collected and processed
• The data retention and deletion policies and practices
• The data security and encryption measures and standards
• The data sharing and disclosure practices and procedures, including the use of third parties and cross-border transfers
• The data access, correction, and deletion rights and requests of individuals
• The data breach and incident response and notification procedures and responsibilities
• The data protection officer and contact details
• The data privacy policy review and update process and frequency

Procedures for configuration settings in identity access management are typically not addressed within data privacy policies, as they are more related to the technical and operational aspects of data security and access control. Identity access management (IAM) is a framework of policies, processes, and technologies that enable an organization to manage and verify the identities and access rights of its users and devices3. IAM configuration settings determine how users and devices are authenticated, authorized, and audited when accessing data and resources. IAM configuration settings should be aligned with the data privacy policies and principles, but they are not part of the data privacy policies themselves. IAM configuration settings should be documented and maintained separately from data privacy policies, and should be reviewed and updated regularly to ensure compliance and security. References: 1: What is a Data Privacy Policy? | OneTrust 2: Privacy Policy Checklist: What to Include in Your Privacy Policy 3: What is identity and access management? | IBM : [Identity and Access Management Configuration Settings] : [Why data privacy and third-party risk teams need to work … - OneTrust] : [Privacy Risk Management - ISACA] : [What Every Chief Privacy Officer Should Know About Third-Party Risk …]

Application version control standards for software release updates are not part of the IT change management approval process, but rather a technical aspect of the software development lifecycle. The IT change management approval process is a formal and structured way of evaluating, authorizing and scheduling changes to IT systems and infrastructure, based on predefined criteria and roles. The IT change management approval process typically includes the following components123:

• A change request form that captures the details, rationale, impact, risk and benefits of the proposed change
• A change approval board (CAB) or other authorized approvers who review and approve or reject the change request based on the business case, feasibility and alignment with the organization’s objectives and policies
• A documented audit trail for all changes, especially emergency changes, that records the date, time, reason, approver and outcome of each change
• A defined roles and responsibilities matrix that clarifies the expectations and accountabilities of each stakeholder involved in the change management process, such as the change manager, change owner, change coordinator, change implementer and change requester
• A set of guidelines that restrict the approval of changes to only authorized personnel who have the appropriate knowledge, skills and authority to make decisions about the changes References:
• 1: Change Approval Process in ITIL Change Management
• 2: Guide to the IT Change Requests Approval Process
• 3: Overview of the change management approval process

A documented process to gain approvals for use of open source applications is typically not part of evaluating the vendor’s patch management controls, because it is not directly related to the patching process. Patch management controls are the policies, procedures, and tools that enable an organization to identify, acquire, install, and verify patches for software vulnerabilities. Patch management controls aim to reduce the risk of exploitation of known software flaws and ensure the functionality and compatibility of the patched systems. A documented process to gain approvals for use of open source applications is more relevant to the software development and procurement processes, as it involves assessing the legal, security, and operational implications of using open source software components in the vendor’s products or services. Open source software may have different licensing terms, quality standards, and support levels than proprietary software, and may introduce additional vulnerabilities or dependencies that need to be managed. Therefore, a documented process to gain approvals for use of open source applications is a good practice for vendors, but it is not a patch management control per se. References:

• Guide to Enterprise Patch Management Planning
• Governance of Key Aspects of System Patch Management
• Certified Third Party Risk Professional (CTPRP) Study Guide

 When a vendor contract terminates, one of the most important requirements for managing risk is to ensure that the vendor securely destroys or returns any data or assets that belong to the organization or its customers. This is to prevent any unauthorized access, use, disclosure, or loss of sensitive information or resources that could result in legal, regulatory, reputational, or financial consequences. The organization should also verify that the vendor complies with this requirement by requesting evidence or conducting audits.

The other options are also important, but not as critical as ensuring data and asset security. Performing a financial review of outstanding invoices is necessary to avoid overpaying or underpaying the vendor, and to resolve any disputes or claims. Performing a final assessment based on due diligence standards is useful to evaluate the vendor’s performance, identify any issues or gaps, and document any lessons learned or best practices. Defining contract terms for transition services is helpful to facilitate a smooth and orderly handover of responsibilities, deliverables, or processes to another vendor or internal team.

References:

• 1: Shared Assessments, a leading provider of third party risk management solutions, offers a comprehensive guide for Certified Third Party Risk Professional (CTPRP) candidates, which covers the core concepts and best practices of third party risk management, including vendor offboarding and termination.
• 2: Prevalent, a platform for third party risk management, provides a blog post on vendor offboarding and termination risk management, which includes a checklist and a template for secure data and asset destruction or return.
• 3: Spendflo, a platform for vendor risk management, provides a guide on vendor risk management, which includes the importance of data and asset security when terminating vendor contracts.

Controls evaluation is the process of verifying and validating the effectiveness of the controls implemented by the third party to mitigate the identified risks. It involves reviewing the evidence provided by the third party, such as policies, procedures, certifications, attestations, or test results, to determine if the controls are adequate, consistent, and compliant with the requirements and standards of the organization. Controls evaluation also involves analyzing the assessment results to identify any gaps, weaknesses, or issues in the third party’s controls, and reporting the findings and recommendations to the relevant stakeholders. Negotiating contract terms for the right to audit is not a component of controls evaluation, but rather a component of contract management. Contract management is the process of establishing, maintaining, and enforcing the contractual agreements between the organization and the third party. It involves defining the roles, responsibilities, expectations, and obligations of both parties, as well as the terms and conditions for service delivery, performance measurement, risk management, dispute resolution, and termination. Negotiating contract terms for the right to audit is a key aspect of contract management, as it allows the organization to monitor and verify the third party’s compliance with the contract and the applicable regulations and standards. It also enables the organization to conduct independent audits or assessments of the third party’s controls, processes, and performance, and to request remediation actions if necessary. References:

• 1: Shared Assessments, a leading provider of third party risk management solutions, offers a comprehensive guide for Certified Third Party Risk Professional (CTPRP) candidates, which covers the core concepts and best practices of third party risk management, including controls evaluation and contract management.
• 2: UpGuard, a platform for cybersecurity and third party risk management, provides a detailed overview of the best practices for third party risk assessment, which includes the steps and criteria for evaluating the controls of third parties.
• 3: Deloitte, a global professional services firm, offers an end-to-end managed service for third party risk management, which includes controls evaluation and contract management as key components of the service.

According to the Shared Assessments CTPRP Study Guide, the business unit relationship owner is the primary point of contact for the third party and is responsible for ensuring that the third party meets the contractual obligations and service level agreements. The business unit relationship owner is also involved in the third party risk assessment process and the remediation plan approval. Therefore, a meeting should be scheduled with the business unit relationship owner before sharing the findings and remediation plans with the third party, as they have the authority and accountability to approve or reject the plans. The other options are not necessarily involved in the remediation plan approval, although they may have other roles in the third party risk management lifecycle. References:

• Shared Assessments CTPRP Study Guide, page 9, section 1.3.2
• The Third-Party Vendor Risk Management Lifecycle, section on Supplier Onboarding & Risk Monitoring
• Remediation vs. Mitigation, section on Remediation

An enterprise information security policy (EISP) is a management-level document that details the organization’s philosophy, objectives, and expectations regarding information security. It sets the direction, scope, and tone for all security efforts and provides a framework for developing and implementing security programs and controls. According to the web search results from the search_web tool, some of the key elements of an EISP are:

• A statement of the organization’s security vision, mission, and principles that align with its business goals and values123.
• A definition of the organizational structure and accountabilities for oversight, governance, and management of information security, including roles and responsibilities of senior executives, security officers, business units, and users123 .
• A specification of the legal and regulatory compliance requirements and obligations that the organization must adhere to, such as data protection, privacy, and breach notification laws123 .
• A description of the scope and applicability of the EISP, including the types of information, systems, and assets that are covered, and the exclusions or exceptions that may apply123 .
• A declaration of the effective date and date of last review by management, as well as the frequency and criteria for reviewing and updating the EISP to ensure its relevance and adequacy123 .
• A statement of the organization’s risk appetite and tolerance, and the process for identifying, assessing, and treating information security risks123 .
• A provision of the authority and responsibility for implementing, enforcing, monitoring, and auditing the EISP and its related policies, standards, procedures, and guidelines123 .
• A determination of the access control policy and the rules for granting, revoking, and reviewing access rights and privileges to information, systems, and assets123 .
• An organization of the EISP based on an accepted control framework, such as ISO 27001, NIST SP 800-53, or COBIT, that defines the security domains, objectives, and controls that the organization must implement and maintain123 .

However, option C, a statement that security policies should be changed on an annual basis due to technology changes, is not an accurate reflection of an organization’s requirements within an EISP. While technology changes may affect the security environment and the threats and vulnerabilities that the organization faces, they are not the only factor that determines the need for changing security policies. Other factors, such as business changes, legal changes, risk changes, audit findings, incident reports, and best practices, may also trigger the need for reviewing and updating security policies. Therefore, option C is the correct answer, as it is the only one that does not reflect an organization’s requirements within an EISP. References: The following resources support the verified answer and explanation:

• 1: What Is The Purpose Of An Enterprise Information Security Policy?
• 2: Enterprise Information Security Policies and Standards
• 3: Key Elements Of An Enterprise Information Security Policy
• : Enterprise Information Security Policy (EISP) - SANS

Vendor management is the process of coordinating with vendors to ensure excellent service to your customers12. It involves activities such as selecting vendors, negotiating contracts, controlling costs, reducing vendor-related risks and ensuring service delivery12. One of the key activities of vendor management is managing service level agreements (SLAs), which are contracts that define the expectations and obligations of both parties regarding the quality, quantity, and timeliness of the goods or services provided3. SLAs help to monitor and measure vendor performance, identify and resolve issues, and enforce penalties or rewards based on the agreed-upon metrics3. The other options are not correct because they do not reflect the concept of vendor management as a whole, but rather specific aspects or tools of vendor management. Scanning and collecting information from third party web sites, reviewing and analyzing external audit reports, and receiving and analyzing a vendor’s response to a questionnaire are all examples of methods or sources of information that can be used to conduct vendor due diligence, risk assessment, or performance evaluation, but they are not the only or the most important activities of vendor management. References:

• What is Vendor Management? Definition, Process, and Tools
• What is vendor management? | Definition & Process | Taulia
• Essential Guide to Vendor Management | Smartsheet, section “Service Level Agreements”

 Performing due diligence during third party risk assessments is a process of verifying and validating the information provided by the third parties, as well as identifying and assessing any potential risks or issues that may arise from the relationship. Due diligence methods may vary depending on the type, scope, and complexity of the third party engagement, but they generally involve the following steps123:

• Interviewing subject matter experts or control owners: This method involves engaging with the relevant stakeholders from both the organization and the third party, such as business owners, project managers, legal counsel, compliance officers, security analysts, etc. The purpose of the interviews is to gather more information about the third party’s capabilities, processes, policies, performance, and challenges, as well as to clarify any questions or concerns that may arise from the questionnaire or other sources. The interviews can also help to establish rapport and trust between the parties, and to identify any gaps or discrepancies in the information provided.
• Reviewing compliance artifacts: This method involves examining the evidence or documentation that supports the third party’s claims or assertions, such as certifications, accreditations, audit reports, policies, procedures, contracts, SLAs, etc. The purpose of the review is to verify the accuracy, completeness, and validity of the artifacts, as well as to assess the level of compliance with the applicable standards, regulations, and best practices. The review can also help to identify any areas of improvement or weakness in the third party’s controls or processes.
• Validating controls: This method involves testing or inspecting the actual implementation and effectiveness of the third party’s controls or processes, such as security measures, quality assurance, data protection, incident response, etc. The purpose of the validation is to confirm that the controls are operating as intended and expected, and that they are sufficient to mitigate the risks or issues identified in the assessment. The validation can also help to identify any vulnerabilities or gaps in the third party’s controls or processes.

The other options are not as comprehensive or accurate as the methods described above, as they may not cover all the aspects or dimensions of the third party risk assessment, or they may rely on incomplete or outdated information. Inspecting physical and environmental security controls by conducting a facility tour is only one part of the validation method, and it may not be applicable or feasible for all types of third parties, such as cloud service providers or remote workers. Reviewing status of findings from the questionnaire and defining remediation plans is more of a follow-up or monitoring activity, rather than a due diligence method, as it assumes that the questionnaire has already been completed and analyzed. Reviewing and assessing only the obligations that are specifically defined in the contract is a narrow and limited approach, as it may not capture the full scope or complexity of the third party relationship, or the dynamic and evolving nature of the risks or issues involved. References:

• Third Party Due Diligence – a vital but challenging process
• The guide to risk based third party due diligence - VinciWorks
• Third Party Risk Assessment – Checklist & Best Practices

Software as a Service (SaaS) is a cloud deployment model that provides users with access to software applications over the internet, without requiring them to install, maintain, or update the software on their own devices. SaaS is primarily focused on the application layer, as it delivers the complete functionality of the software to the end users, while abstracting away the underlying infrastructure, platform, and middleware layers. SaaS providers are responsible for managing the servers, databases, networks, security, and scalability of the software, as well as ensuring its availability, performance, and compliance. SaaS users only pay for the software usage, usually on a subscription or pay-per-use basis, and can access the software from any device and location, as long as they have an internet connection. Some examples of SaaS applications are Gmail, Salesforce, Dropbox, and Netflix. References:

• Shared Assessments CTPRP Study Guide, page 15, section 2.2.2
• Cloud Computing Deployment Models and Architectures, section on Cloud Computing Models
• Layered Architecture of Cloud, section on Application Layer

Contract addendums are supplementary documents that modify or amend the original contract terms. They can be used to address third party risk obligations, such as security, privacy, compliance, or performance standards, without having to rewrite the entire MSA. However, contract addendums should be consistent with the MSA and clearly specify the scope, duration, and responsibilities of each party. Contract addendums can also be used to update or revise the contract terms in response to changing business needs or regulatory requirements12.

The other statements are true regarding the different types of contracts and agreements between outsourcers and service providers. Evergreen contracts are contracts that do not have a fixed end date and are automatically renewed unless one party decides to terminate them under the existing contract provisions3. RFPs are documents that solicit proposals from potential service providers for a specific project or service. RFPs should include mandatory requirements based on an organization’s TPRM program policies, standards and procedures, such as risk assessment, due diligence, monitoring, reporting, and remediation . SOWs are documents that define the operational requirements and obligations for each party, such as the scope, deliverables, timelines, costs, quality, and performance metrics . References:

• 1: Contracts and third-party risk - KPMG UK
• 2: Third-Party Risk & Contract Management: A Comprehensive Beginner’s Guide - Trackado
• 3: What Is an Evergreen Contract? | Legal Beagle
• : [Best Practices Guidance for Third Party Risk - GARP]
• : Third-Party Risk Management: A Comprehensive Guide - UpGuard
• : Statement of Work (SOW) - Definition, Contents & Examples
• : How to Write a Statement of Work for Any Industry | Smartsheet

Change management is the process of controlling and documenting any changes to the scope, objectives, requirements, deliverables, or resources of a project or a program. Change management ensures that the impact of any change is assessed and communicated to all stakeholders, and that the changes are implemented in a controlled and coordinated manner. Compliance artifacts are the documents, records, or reports that demonstrate the adherence to the change management process and the regulatory or industry standards.

A robust change management process should include the following attributes:

• Logging: This means that any change request or proposal is recorded in a change log or a change register, along with the details of the change initiator, the change description, the change category, the change priority, the change status, and the change history. Logging helps to track and monitor the progress and outcome of each change, and to provide an audit trail for compliance purposes.
• Approvals: This means that any change request or proposal is reviewed and approved by the appropriate authority or stakeholder, such as the project manager, the sponsor, the customer, the steering committee, or the regulatory body. Approvals help to ensure that the change is justified, feasible, aligned with the project or program objectives, and acceptable to the affected parties.
• Validation: This means that any change request or proposal is verified and tested to ensure that it meets the quality standards, the functional and non-functional requirements, and the expected benefits and outcomes. Validation helps to ensure that the change is implemented correctly, effectively, and efficiently, and that it does not introduce any errors, defects, or risks.
• Back-out and exception procedures: This means that any change request or proposal has a contingency plan or a rollback plan in case the change fails, causes problems, or is rejected. Back-out and exception procedures help to minimize the negative impact of the change, and to restore the original state or the baseline of the project or program. They also help to handle any deviations or issues that may arise during the change implementation or the change review.

References:

• CTPRP Job Guide
• An Agile Approach to Change Management
• CM Overview
• Management Artifacts and its Types
• Achieving Regulatory and Industry Standards Compliance with the Scaled Agile Framework
• 8 Steps for an Effective Change Management Process

In the ‘Defense in Depth’ security model, the innermost layer typically focuses on protecting the most sensitive and critical assets, which are often categorized as 'Private internal'. This layer includes security controls and measures that are designed to safeguard the core, confidential aspects of an organization's infrastructure and data. It encompasses controls such as access controls, encryption, and monitoring of sensitive systems and data to prevent unauthorized access and ensure data integrity and confidentiality. The 'Private internal' layer is crucial for maintaining the security of critical information and systems that are essential to the organization's operations and could have the most significant impact if compromised. Implementing robust security measures at this layer is vital for mitigating risks associated with physical access to critical infrastructure and sensitive information.

References:

• Security frameworks and standards, including NIST SP 800-53 (Security and Privacy Controls for Federal Information Systems and Organizations) and the SANS Institute's guidelines on implementing 'Defense in Depth', provide detailed recommendations on securing the innermost layers of an organization's information systems.
• Publications such as "Physical Security Principles" by ASIS International offer insights into best practices for securing the private internal layer, including access control systems, surveillance, and intrusion detection mechanisms.

 ESG programs are initiatives that aim to improve the environmental, social, and governance performance of a vendor or service provider. ESG programs may be driven by various factors, such as regulatory obligations, customer expectations, stakeholder pressure, industry standards, or company commitments. Therefore, statement B is true and the correct answer is B. Statement A is false because ESG expectations may come from external entities, such as regulators, investors, customers, or civil society. Statement C is false because ESG commitments can be measured both qualitatively and quantitatively, using indicators such as carbon emissions, diversity, ethics, or compliance. Statement D is false because ESG obligations may apply to any company, regardless of its size, ownership, or sector. References:

• Third-party risk management and the ESG agenda
• ESG third-party risk
• The Role of Third-Party Risk Management in ESG Compliance

Continuous monitoring is a process of collecting and analyzing data on the performance and security of third-party vendors on an ongoing basis. Continuous monitoring helps to identify and mitigate potential risks, such as data breaches, credential exposures, insider fraud/theft, and other cyber incidents, that may affect the organization and its customers. Continuous monitoring can use various techniques, such as monitoring surface, vulnerabilities, passive and active indicators of compromise, and business intelligence.

Passive and active indicators of compromise are examples of continuous monitoring techniques that track the signs of malicious activity or compromise on the third-party vendor’s systems or networks. Passive indicators of compromise are data sources that do not require direct interaction with the target, such as threat intelligence feeds, dark web monitoring, or external scanning. Active indicators of compromise are data sources that require direct interaction with the target, such as penetration testing, malware analysis, or incident response. Both passive and active indicators of compromise can provide valuable information on the current state and potential threats of the third-party vendor’s environment.

The other options are not examples of continuous monitoring techniques that track breach, credential exposure and insider fraud/theft alerts. Monitoring surface is a technique that measures the size and complexity of the third-party vendor’s attack surface, such as the number and type of internet-facing assets, domains, and services. Vulnerabilities are a technique that identifies the weaknesses or flaws in the third-party vendor’s systems or applications that can be exploited by attackers, such as outdated software, misconfigurations, or unpatched bugs. Business intelligence is a technique that analyzes the business performance and reputation of the third-party vendor, such as financial stability, customer satisfaction, or regulatory compliance. References:

• Guide: Continuous Monitoring for Third-Party Risk
• Continuous Monitoring - Third Party Risk Management
• 12 Ongoing Monitoring Best Practices for Third-Party Risk Management

The concept of least privilege is a security principle that requires giving each user, service, and application only the permissions needed to perform their work and no more12. It is one of the most important concepts in network and system security, as it reduces the attack surface and the risk of unauthorized access, data breaches, and malware infections12. The statement B best describes this concept, as it implies that the vendor follows the principle of least privilege by granting people access to the minimum necessary to do their job. The other statements do not capture the essence of the concept, as they either describe other security practices (such as dual authorization and separation of duties) or limit the scope of the concept to a specific type of access (such as root and administrator access).

References:

• 1: 9 Ways to Prevent Third-Party Data Breaches in 2024 | UpGuard
• 2: Best Practice Guide to Implementing the Least Privilege Principle - Netwrix

End-user device policies are policies that establish the rules and requirements for the use and management of devices that access organizational data, networks, and systems. These policies typically include user obligations that define the responsibilities and expectations of the users regarding the security, privacy, and compliance of the devices they use. According to the web search results from the search_web tool, some common user obligations defined in end-user device policies are:

• A statement specifying the owner of data on the end-user device: This statement clarifies who owns the data stored on the device, whether it is the organization, the user, or a third party. This statement also defines the rights and obligations of the data owner and the data custodian, such as the access, retention, disposal, and protection of the data123.
• A statement that defines the process to remove all organizational data, settings and accounts at offboarding: This statement outlines the steps and procedures that the user must follow to securely erase or transfer all organizational data, settings, and accounts from the device when they leave the organization or change their role. This statement also specifies the roles and responsibilities of the user, the organization, and the device manager in ensuring the proper offboarding of the device143.
• A statement detailing user responsibility in ensuring the security of the end-user device: This statement describes the actions and measures that the user must take to protect the device from unauthorized access, theft, loss, damage, or compromise. This statement may include requirements such as enabling encryption, password, firewall, antivirus, updates, and backups, as well as reporting any incidents or issues related to the device1435.

However, option D, a statement that specifies the ability to synchronize mobile device data with enterprise systems, is not a user obligation defined in end-user device policies. Rather, this statement is a feature or functionality that may be enabled or disabled by the organization or the device manager, depending on the security and compliance needs of the organization. This statement may also be part of a device configuration policy or a mobile device management policy, which are different from end-user device policies. Therefore, option D is the correct answer, as it is the only one that does not reflect a user obligation defined in end-user device policies. References: The following resources support the verified answer and explanation:

• 1: End-User Device Policy | IT Services - University of Chicago
• 4: Device compliance policies in Microsoft Intune | Microsoft Learn
• 2: Basics of an End User Computing Policy - Apparity Blog
• 3: End-User Device Management Standard Operating Procedure
• 5: End-User Devices | Information Security - University of Chicago

A risk register is a tool that records and tracks the identified risks, their probability, impact, status, and mitigation actions throughout the life cycle of a third-party relationship1. A risk register typically includes the following components2:

• A unique identifier for each risk
• A description of the risk and its source
• A rating or grading of the risk according to a risk assessment table or hierarchy
• An assessment of the impact and likelihood the risk will occur and the possible seriousness
• An outline of proposed mitigation actions and assignment of risk owner
• A status update on the risk and the progress of the mitigation actions
• A target date for resolving the risk or closing the action A vendor inventory is a list of all the third parties that a banking organization engages with, along with relevant information such as the type, scope, and nature of the services provided, the contract terms and conditions, the performance indicators, and the risk ratings3. A vendor inventory is not a component of a risk register, but rather a separate document that supports the planning and due diligence phases of the third-party relationship life cycle. A vendor inventory may be prioritized by contract value, but also by other criteria such as the criticality of the service, the risk level of the vendor, and the strategic importance of the relationship. References:
• 1: Third-Party Risk Management (TPRM): Final Interagency Guidance, KPMG, June 2023
• 2: What Is Third-Party Risk Management (TPRM)? 2024 Guide, UpGuard, January 2024
• 3: Third-Party Risk Management Guidance, OCC Bulletin 2023-29, October 2023
• [4]: Certified Third Party Risk Professional (CTPRP) Study Guide, Shared Assessments, 2023
• [5]: Best Practices Guidance for Third-Party Risk, GARP, February 2023

While whistleblower compliance issue reporting mechanisms are important for ensuring ethical conduct and accountability within an organization, they are not directly related to the security and privacy awareness of the service provider’s employees and contractors. The other topics are more relevant for assessing the service provider’s ability to protect the organization’s sensitive data and systems from external and internal threats, such as phishing, social engineering, unauthorized access, data breaches, etc. Therefore, B is the least important topic when evaluating a service provider’s Security and Privacy Awareness Program. References:

• Shared Assessments CTPRP Study Guide, page 43, section 4.2.3: Security and Privacy Awareness Program
• Third-Party Security: 8 Steps To Assessing Risks And Protecting Your Ecosystem, step 4: Evaluate the vendor’s security awareness and training program
• What Is Third-Party Risk Management, section: How to Implement a Third-Party Risk Management Program, bullet point: Security and privacy awareness training

The primary objective of a third party risk assessment is to validate that the vendor/service provider has adequate controls in place based on the organization’s risk posture. A third party risk assessment (also known as supplier risk assessment) quantifies the risks associated with third-party vendors and suppliers that provide products or services to your organization1. This assessment is useful for analyzing both new and ongoing supplier relationships. The growing risk of supply chain attacks makes it critical to conduct thorough and regular risk assessments of your third parties. A third party risk assessment helps you identify, measure, and mitigate the potential risks that your third parties pose to your organization, such as data breaches, cyberattacks, compliance violations, operational disruptions, reputational damage, or financial losses. A third party risk assessment also helps you align your third party risk management (TPRM) program with your organization’s risk appetite, policies, standards, and procedures. A third party risk assessment typically involves the following steps1:

• Scoping: Define the scope of the assessment based on the type, nature, and criticality of the third party relationship. Determine the relevant risk domains, such as security, privacy, compliance, business continuity, etc.
• Data collection: Gather information from the third party using various methods, such as questionnaires, surveys, interviews, audits, tests, or evidence reviews.
• Analysis: Analyze the data collected and compare it with your organization’s risk criteria, benchmarks, and best practices. Identify any gaps, weaknesses, or issues in the third party’s controls, processes, or performance.
• Reporting: Document the findings and recommendations of the assessment in a clear and concise report. Communicate the results to the relevant stakeholders, such as senior management, business owners, or regulators.
• Remediation: Follow up with the third party to ensure that they implement the necessary actions to address the identified risks. Monitor and track the progress and effectiveness of the remediation plan.
• Review: Review and update the assessment periodically or whenever there are significant changes in the third party relationship, the risk environment, or the regulatory requirements.

The other statements are not the primary objective of a third party risk assessment, although they may be related or secondary objectives. Assessing the appropriateness of non-disclosure agreements regarding the organization’s systems/data is a legal objective that may be part of the contract negotiation or review process. Determining the scope of the business relationship is a strategic objective that may be part of the vendor selection or due diligence process. Evaluating the risk posture of all vendors/service providers in the vendor inventory is a holistic objective that may be part of the vendor risk management or governance process. References:

• 1: Third-Party Risk Assessment: A Practical Guide - BlueVoyant
• : What Is Third-Party Risk Management (TPRM)? 2024 Guide | UpGuard
• : What is Third-Party Risk Management? | Blog | OneTrust

 Criticality is a measure of how essential a service provider is to the organization’s core business functions and objectives. It reflects the potential consequences of a service disruption or failure on the organization’s operations, reputation, compliance, and financial performance. Criticality is not the same as risk, which is the likelihood and severity of a negative event occurring. Criticality helps to prioritize the risk assessment and mitigation efforts for different service providers based on their relative importance to the organization. Criticality is not limited to a specific type of service, such as disaster recovery or personal information, nor is it determined by the mode of access or connectivity. Criticality is assigned to the service providers that have the greatest impact on the organization’s ability to deliver its products or services to its customers and stakeholders in a timely and satisfactory manner. References:

• Shared Assessments. (2020). Certified Third Party Risk Professional (CTPRP) Study Guide1
• Milliman. (2017). Defining “critical or important functions or activities” for outsourcing purposes2
• Webster, C. and Sundaram, D.S. (2009). Effect of service provider’s communication style on customer satisfaction in professional services setting: the moderating role of criticality and service nature. Journal of Services Marketing, 23(2), 103-1131

According to the Certified Third Party Risk Professional (CTPRP) Job Guide, one of the key tasks of a third party risk professional is to “manage the corrective action process for identified issues and ensure timely resolution” (p. 10). This task involves the following steps:

• Document the findings and recommendations from the assessment and communicate them to the appropriate stakeholders
• Review the findings and recommendations with the line of business (LOB) and obtain their risk acceptance or rejection
• If the LOB accepts the risk, document the rationale and approval in the risk register
• If the LOB rejects the risk, work with the vendor to develop a remediation plan that addresses the root cause and mitigates the risk
• Monitor the progress and completion of the remediation plan and verify the effectiveness of the corrective actions
• Update the risk register and the vendor profile with the results of the remediation

Therefore, the statement that best represents the roles and responsibilities for managing corrective actions is C, as it reflects the need to review the findings and need for remediation with the LOB for risk acceptance before sharing the remediation plan with the vendor. This ensures that the LOB is aware of the risks and their impact, and that the vendor is committed to resolving the issues in a timely and satisfactory manner.

References:

• CTPRP Job Guide, Shared Assessments, 2020
• Best Practices Guidance for Third Party Risk, Global Association of Risk Professionals (GARP), 2019
• Simple Guide for Corrective and Preventative Action (CAPA), Qualcy eQMS, 2020
• [The Three Key Parts of an EHS Corrective Action Plan], EHS Daily Advisor, 2021

Fourth-Nth party risk refers to the potential threats and vulnerabilities associated with the subcontractors, vendors, or service providers of an organization’s direct third-party partners. This can create a complex network of dependencies and exposures that can affect the organization’s security, data protection, and business resilience. To manage this risk effectively, organizations should conduct comprehensive due diligence on their extended vendor and supplier network, and include contractual stipulations that require notification and approval for any subcontracting activities. This way, the organization can ensure that the subcontractors meet the same standards and expectations as the direct third-party partners, and that they have adequate controls and safeguards in place to protect the organization’s data and systems. Additionally, the organization should monitor and assess the performance and compliance of the subcontractors on a regular basis, and update the contract provisions as needed to reflect any changes in the risk environment. References:

• Understanding 4th- and Nth-Party Risk: What Do You Need to Know?
• Best Practices for Fourth and Nth Party Management
• Fourth-Party Risk Management: Best Practices

This statement is false because network connectivity or remote access may trigger a higher vendor risk classification for any third party that has access to the organization’s network, systems, or data, regardless of whether they process personal information or not. Network connectivity or remote access increases the exposure of the organization to cyberattacks, data breaches, or unauthorized access by malicious actors. Therefore, the organization should assess the security controls and practices of the third party, such as encryption, authentication, firewall, antivirus, and patch management, to ensure that they meet the organization’s standards and expectations. The organization should also monitor the network activity and performance of the third party, and establish clear policies and procedures for granting, revoking, or modifying access rights. The other statements (A, B, and C) are true regarding the primary factors in determining vendor risk classification, as they reflect the potential impact, likelihood, and severity of the risks associated with the vendor’s location, importance, and data processing. References:

• Vendor Classification, Shared Assessments
• Impact of Risk Attributes on Vendor Risk Assessment and Classification, SSRN
• Guide to Vendor Risk Assessment, Smartsheet
• How Do You Determine Vendor Criticality?, UpGuard

A Business Impact Analysis (BIA) is a process of determining the criticality of business activities and associated resource requirements to ensure operational resilience and continuity of operations during and after a business disruption1. A BIA is used to identify the potential impacts of disruptions on business processes, such as lost sales, delayed revenue, increased expenses, regulatory fines, or contractual penalties2. A BIA is not concerned with the probability or causes of disruptions, but rather with the effects and consequences of disruptions3. Therefore, a BIA typically does not include requiring vendor participation in testing, as this is a part of the business continuity and disaster recovery planning and implementation, not the impact analysis. Vendor participation in testing is important to validate the effectiveness and alignment of the vendor’s business continuity and disaster recovery plans with the organization’s objectives and expectations, but it is not a component of the BIA itself. References: 1: Using Business Impact Analysis to Inform Risk Prioritization and Response 2: Business Impact Analysis (BIA): Prepare for Anything [2024] • Asana 3: The Difference Between a Vendor’s BIA and Risk Analysis - Venminder : Best Practices Guidance for Third Party Risk

Remote wipe is a security feature that allows an administrator or a user to remotely erase all the data and settings on a device in case it is lost or stolen. This prevents unauthorized access to sensitive information and reduces the risk of data breaches. Remote wipe is typically used for company-owned devices, as it ensures that no company data remains on the device after it is lost or stolen. Remote wipe also restores the device to its factory settings, making it unusable for the thief or finder. Remote wipe can be performed through various methods, such as using a mobile device management (MDM) solution, a cloud service, or a built-in feature of the device’s operating system. References:

• 1: How to protect your company from data breaches caused by lost or stolen devices
• 2: BYOD vs Company-Owned Devices: How to Maintain Security
• 3: Lost or Stolen Business Device? Here’s What to do Next

According to the Shared Assessments Certified Third Party Risk Professional (CTPRP) Study Guide, physical security compliance is the process of ensuring that the physical assets and personnel of an organization are protected from unauthorized access, theft, damage, or harm1. Physical security compliance can be achieved by implementing various measures, such as locks, alarms, cameras, guards, fences, badges, etc. However, these measures need to be regularly monitored, tested, and verified to ensure their effectiveness and alignment with the defined standards and policies2. Therefore, maintaining a standardized schedule for confirming controls to defined standards demonstrates a greater maturity of physical security compliance, as it indicates a proactive and consistent approach to assessing and improving the physical security posture of an organization3.

The other options do not reflect a high level of physical security compliance maturity, as they either rely on reactive or ad hoc methods, or lack sufficient verification and validation mechanisms. Leveraging periodic reporting to schedule facility inspections based on reported events may indicate a lack of preventive and predictive measures, as well as a dependency on external or internal incidents to trigger the inspections. Providing a checklist for self-assessment may indicate a lack of independent and objective evaluation, as well as a potential for bias or error in the self-assessment process. Conducting unannounced checks on an ad hoc basis may indicate a lack of planning and coordination, as well as a potential for disruption or inconsistency in the checks.

References:

• 1: Shared Assessments Certified Third Party Risk Professional (CTPRP) Study Guide, page 24
• 2: Physical Security: Planning, Measures & Examples + PDF - Avigilon
• 3: Security Maturity Models: Levels, Assessment, and Benefits
• [4]: Best Practices for Planning and Managing Physical Security Resources - CISA, page 10
• [5]: Self-Assessment vs. Independent Assessment: What’s the Difference? | Linford & Company LLP
• [6]: The Pros and Cons of Unannounced Audits | NQA

Shadow IT is the use and management of any IT technologies, solutions, services, projects, and infrastructure without formal approval and support of internal IT departments. Shadow IT can pose significant security risks to the organization, such as data breaches, compliance violations, malware infections, or network disruptions. Therefore, assessing and mitigating the risk of shadow IT is an essential part of organizational security.

One of the most important factors when assessing the risk of shadow IT is whether the organization maintains adequate policies and procedures that communicate required controls for security functions. Policies and procedures are the documents that define the organization’s security objectives, standards, roles, responsibilities, and processes. They provide guidance and direction for the organization’s security activities, such as risk assessment, vendor management, incident response, data protection, access control, etc. They also establish the expectations and requirements for the organization’s employees, vendors, and other stakeholders regarding the use and management of IT resources.

By maintaining adequate policies and procedures that communicate required controls for security functions, the organization can:

• Educate and inform its employees about the security risks and implications of shadow IT, and the benefits and advantages of using authorized and supported IT resources.
• Establish and enforce clear and consistent rules and boundaries for the use and management of IT resources, and the consequences and penalties for violating them.
• Monitor and audit the compliance and performance of its employees, vendors, and other stakeholders regarding the use and management of IT resources, and identify and address any deviations or issues.
• Review and update its policies and procedures regularly, and communicate any changes or updates to its employees, vendors, and other stakeholders.

By doing so, the organization can reduce the likelihood and impact of shadow IT, and increase the visibility and accountability of its IT environment. The organization can also foster a culture of security awareness and responsibility among its employees, vendors, and other stakeholders, and encourage them to report and resolve any shadow IT incidents or problems.

The other factors, such as the organization’s security training and certification, staffing levels, and resources and investment, are also relevant for assessing the risk of shadow IT, but they are not as important as the organization’s policies and procedures. Security training and certification can help the organization’s security personnel to acquire and maintain the necessary skills and knowledge to deal with shadow IT, but they do not address the root causes or motivations of shadow IT. Staffing levels can affect the organization’s ability to detect and respond to shadow IT, but they do not prevent or deter shadow IT from occurring. Resources and investment can enable the organization to provide adequate and appropriate IT resources to its employees, vendors, and other stakeholders, but they do not guarantee the satisfaction or compliance of those parties. References:

• : Shadow IT Explained: Risks & Opportunities - BMC Software
• : What is Shadow IT? | IBM
• : Shadow IT: What Are the Risks and How Can You Mitigate Them? - Ekran System
• : Policies and Procedures - Shared Assessments