Third-Party and Vendor Risk Management Flashcards
7 cards from real CRISC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Third-Party and Vendor Risk Management flashcards as text
Concentration risk in third-party management occurs when:
Answer: A single vendor provides services to multiple business units or critical functions
Concentration risk arises when over-reliance on a single vendor means their failure could simultaneously disrupt multiple critical organizational functions.
Under the shared responsibility model for cloud services, who is responsible for classifying and protecting customer data stored in the cloud?
Answer: The customer organization
Under the shared responsibility model, the customer organization retains responsibility for data classification, access control, and data protection even when data resides in the cloud.
What is the BEST approach for managing vendor risk when a vendor refuses to allow direct audits?
Answer: Require the vendor to provide third-party audit reports such as SOC 2 Type II
Independent third-party audit reports like SOC 2 Type II provide objective assurance of vendor control effectiveness when direct audits are not permitted.
A vendor risk register should PRIMARILY contain:
Answer: Identified risks associated with each vendor, their likelihood, impact, and mitigating controls
A vendor risk register documents risks per vendor alongside risk ratings and controls, enabling systematic tracking and management of third-party risk exposure.
Which regulatory framework explicitly requires organizations to assess and manage third-party risks for financial institutions?
Answer: FFIEC IT Examination Handbook (Third-Party Relationships)
The FFIEC IT Examination Handbook on Third-Party Relationships provides specific regulatory guidance for financial institutions on managing vendor and third-party risks.
During a vendor security incident that affects your organization's data, what is the FIRST step the organization should take?
Answer: Activate the incident response plan and notify relevant internal stakeholders
Activating the incident response plan ensures a coordinated, timely response that limits further damage and fulfills regulatory notification obligations.
What is the purpose of a Data Processing Agreement (DPA) in vendor contracts?
Answer: To define terms under which a vendor may process personal data on behalf of the organization
A DPA legally defines the terms of personal data processing by a vendor acting as a data processor, a requirement under frameworks like GDPR and CCPA.