Third-Party and Vendor Risk Management Flashcards
7 cards from real CRISC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Third-Party and Vendor Risk Management flashcards as text
Which activity is MOST important when onboarding a new critical third-party vendor?
Answer: Conducting a thorough due diligence risk assessment
Due diligence risk assessment is essential before onboarding critical vendors to identify security, financial, and operational risks they may introduce.
A 'fourth-party risk' in vendor management refers to:
Answer: Risk from subcontractors or suppliers used by your primary vendors
Fourth-party risk refers to the risk introduced by vendors that your direct (third-party) vendors rely upon, creating an extended supply chain risk.
Which contract provision gives an organization the RIGHT to examine a vendor's controls and compliance posture?
Answer: Right-to-audit clause
A right-to-audit clause contractually permits the organization to conduct audits or assessments of the vendor's security controls and compliance.
When classifying vendors by risk tier, which factor is MOST relevant to assigning a vendor to the highest risk tier?
Answer: The volume of sensitive data the vendor accesses or processes
Vendors who access or process significant volumes of sensitive or regulated data pose the greatest potential impact in a breach, warranting the highest risk tier.
What is the PRIMARY purpose of a Service Level Agreement (SLA) in vendor risk management?
Answer: To set measurable performance and availability expectations that can be monitored
SLAs define specific, measurable service performance targets, enabling the organization to monitor vendor compliance and hold vendors accountable.
An organization terminates its relationship with a cloud vendor. Which action is MOST critical from a risk management perspective?
Answer: Ensuring all organizational data is securely retrieved and deleted from vendor systems
Secure data retrieval and certified deletion prevents residual data exposure, which is the primary risk when offboarding a cloud vendor.
Which metric is MOST useful for ongoing monitoring of a vendor's security risk posture?
Answer: Frequency and severity of security incidents reported by the vendor
Security incident frequency and severity directly reflects the vendor's control effectiveness and their risk to the organization over time.