Third-Party Risk Flashcards

A federal agency wants to use a SaaS offering that already holds a FedRAMP Joint Authorization Board P-ATO. The agency's CISO proposes skipping the agency authorization step because 'the risk has already been accepted at the federal level.' Under the RMF and FedRAMP model, which statement is MOST accurate?

Answer: The agency AO must still issue an agency ATO after reviewing the authorization package, accepting residual risk that includes the customer-responsible controls the agency itself implements

A P-ATO lets the agency reuse an existing assessment, but it does not accept risk for the agency. The agency AO reviews the package (SSP, SAR, POA&M), confirms the customer-responsible controls are in place, and issues its own ATO. Under the RMF, a risk acceptance decision can't be handed to another authorizing official. The agency doesn't have to reassess every control, though, which is the whole reason the authorization can be reused.

A service organization's SOC 2 Type II report covers its hosting services and uses the CARVE-OUT method for a subservice organization that runs its data center operations. The auditor's opinion is unqualified. What is the MOST appropriate next step for the user entity's third-party risk team?

Answer: Get assurance over the subservice organization's controls separately, for example from its own SOC report, because the carve-out means those controls were not tested

Under the carve-out method, the subservice organization's controls are excluded from the description and from testing. Only the monitoring controls the service organization relies on are covered. The unqualified opinion applies only to what was in scope. The user entity has to get assurance some other way, usually from the subservice organization's own SOC report. CUECs are a different thing: they are controls the user entity is expected to run itself, not controls run by a fourth party.

During annual vendor reviews, an organization finds that its payroll provider, its CRM vendor and its backup provider all received clean assessments. Later analysis shows all three host their production workloads in the same single cloud region. Which risk was MISSED, and which practice would have found it?

Answer: Concentration (aggregate fourth-party) risk; found by mapping nth-party dependencies across the whole vendor portfolio instead of assessing each vendor alone

Each vendor can pass its own review while the portfolio as a whole still depends on one shared point of failure. Concentration risk only shows up when you map fourth-party and nth-party dependencies across vendors and add them up, which NIST SP 800-161r1 supports through supply chain mapping. Better reports, re-tiering or audit rights all still look at one vendor at a time, so none of them would reveal the shared dependency.

An organization gets a vendor's SOC 2 Type II report whose review period ended five months ago. To cover the gap up to today, the vendor provides a bridge (gap) letter. How should the risk analyst treat this letter?

Answer: As a management assertion that no material changes happened, useful but not independently tested, so it should be weighed with other evidence

The service organization's management writes and signs the bridge letter. It is not an audit opinion and the auditor has not tested it. It is an accepted way to cover the time between the end of a report period and the present, but it gives less assurance than the report. The analyst should weigh it alongside other evidence such as incident disclosures, monitoring results and questionnaire responses. No AICPA rule voids a report after three months, and a bridge letter does not replace a future audit.

A contract for a critical SaaS vendor includes a right to audit and a breach notification clause. The vendor later moves customer data processing to an offshore subcontractor without telling the customer. Which contract provision would have MOST directly prevented this?

Answer: Flow-down clauses requiring prior notice and approval of subcontractors, with security, data location and audit obligations passed on to those subcontractors

The failure was an unapproved fourth party and a change of data location. Flow-down clauses pass the prime vendor's security, audit and data residency obligations on to subcontractors. A requirement for prior notice and approval gives the customer a say before the change happens. Indemnification and termination rights only help after the fact, and SLAs deal with availability, not subcontracting.

A mid-tier supplier whose risk was accepted last year under an 18-month reassessment cycle is acquired by a company owned by a foreign government. Its services and controls appear unchanged. What is the MOST appropriate response?

Answer: Trigger an event-driven reassessment now, including foreign ownership, control or influence (FOCI) and data access implications, and update the risk decision

A change in ownership, especially one that brings foreign ownership, control or influence, is a major change in the supplier's risk. It should trigger reassessment outside the normal schedule, consistent with continuous monitoring under the RMF and NIST SP 800-161r1 C-SCRM. The new owner could gain legal or practical access to data or influence over operations even if no technical control changes. Ending the contract automatically skips the risk analysis, and re-signing old questionnaire answers adds no new information.