CCM Third-Party and Vendor Compliance Management 3

Question 1

A key vendor notifies your organization of a data breach affecting customer records it was processing on your behalf. What is the compliance manager's first priority?

Accepted Answer

Assess the scope of the breach, activate the incident response plan, and fulfill regulatory notification obligations

Answer

A vendor data breach is an organizational incident requiring immediate scope assessment, incident response activation, and compliance with regulatory breach notification timelines (e.g., 72 hours under GDPR).

Question 2

What is 'inherent risk' in the context of third-party risk assessments?

Accepted Answer

The risk a vendor poses before considering any mitigating controls

Answer

Inherent risk is the level of risk a vendor relationship poses based solely on its nature and characteristics, before any controls, contractual protections, or mitigation measures are factored in.

Question 3

Which of the following best describes a 'vendor exit strategy' in compliance program management?

Accepted Answer

A documented plan for transitioning services away from a vendor with minimal disruption if the relationship must be terminated

Answer

A vendor exit strategy is a documented contingency plan that ensures the organization can smoothly transition critical services to another provider if a vendor relationship ends due to non-compliance, insolvency, or other reasons.

Question 4

An organization discovers that its primary vendor has been using an unapproved subcontractor to handle sensitive data. What compliance principle does this most directly violate?

Accepted Answer

The requirement for prior written consent before subcontracting data processing activities

Answer

Most data protection frameworks and vendor contracts require explicit written approval before a vendor may subcontract data processing, ensuring the organization maintains control and oversight of the full data handling chain.

Question 5

Which ISO standard provides internationally recognized guidance for managing information security risks within the supply chain and third-party relationships?

Accepted Answer

ISO 27036

Answer

ISO 27036 specifically addresses information security for supplier relationships, providing guidelines for managing information security risks across the supply chain and with third-party service providers.

(CCM) Certified Compliance Manager Practice Test

(CCM) Certified Compliance Manager Practice Test

CCM Third-Party and Vendor Compliance Management 3