Third-Party and Vendor Risk Management Flashcards
7 cards from real CRISC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Third-Party and Vendor Risk Management flashcards as text
Which of the following BEST describes a vendor risk appetite statement?
Answer: A formal declaration of the level and type of third-party risk the organization is willing to accept
A vendor risk appetite statement formally defines how much and what types of third-party risk the organization will tolerate, guiding vendor selection and management decisions.
Continuous monitoring of third-party vendors is BEST achieved through:
Answer: Real-time threat intelligence feeds, periodic assessments, and performance metric tracking
Continuous monitoring combines real-time intelligence with periodic structured assessments to provide an up-to-date view of vendor risk posture throughout the relationship lifecycle.
Supply chain risk management in IT focuses primarily on risks from:
Answer: Hardware manufacturers, software vendors, and service providers across the entire IT supply chain
IT supply chain risk encompasses risks from all parties in the chain of hardware, software, and services that ultimately deliver IT capabilities to the organization.
A vendor risk scoring model should incorporate which combination of factors?
Answer: Inherent risk level, control effectiveness, and residual risk rating
Effective vendor risk scoring combines inherent risk (potential exposure) with control effectiveness to derive residual risk, enabling prioritized oversight and resource allocation.
When a critical vendor announces it is going out of business, the organization should FIRST:
Answer: Activate contingency or exit plans and identify alternative vendors
Activating exit and contingency plans ensures business continuity by transitioning to alternative vendors or in-house capabilities before service disruption occurs.
Which standard provides a framework specifically for information security requirements in supplier relationships?
Answer: ISO/IEC 27036 (Information Security for Supplier Relationships)
ISO/IEC 27036 is specifically designed to address information security risks in supplier and customer relationships, providing guidance on policies, controls, and assessment.
What is the MAIN benefit of including a 'business continuity' requirement in vendor contracts?
Answer: It ensures the vendor has tested plans to maintain services during disruptions affecting your organization
Requiring vendors to maintain and test business continuity plans ensures they can sustain service delivery during disruptions, reducing the risk to the organization's own operations.