Third-Party Risk Flashcards

An agency is using a FedRAMP-authorized SaaS provider for a moderate-impact system. The system owner wants to list all the provider's controls as 'inherited' and skip any agency-level review, because FedRAMP already authorized the provider. From a NIST RMF perspective, which statement is MOST accurate?

Answer: The agency can reuse the FedRAMP package, but its own AO still has to review the package and the customer responsibility matrix, confirm the agency-side controls are implemented, and accept the residual risk for the agency's use

Authorization reuse lets an agency use existing assessment evidence, but it does not hand over accountability. Under NIST SP 800-37, the agency's authorizing official still makes the risk decision for the agency's specific use and data. Part of that is checking the customer responsibility matrix, because some controls are shared or belong to the customer and the agency has to implement and assess them itself. A full reassessment isn't required, and the PMO doesn't accept risk for the agency.

A payroll vendor's SOC 2 Type II report uses the CARVE-OUT method for its colocation data center provider. The report also lists several Complementary Subservice Organization Controls (CSOCs). What is the user organization's MOST appropriate next step?

Answer: Get assurance about the colocation provider's relevant controls on its own (for example, its own SOC report) and check whether the CSOCs the vendor relies on are operating

In a carve-out report, the subservice organization's controls are left out of the auditor's testing. The vendor's control objectives still depend on those controls working, which is what the CSOCs describe. So the user organization has to get assurance about the carved-out party some other way, usually that provider's own SOC report, and judge whether the CSOCs are in place. The carve-out method is valid, and the lack of a direct contract doesn't remove fourth-party risk.

During a portfolio-level third-party risk review, a GRC analyst finds that five separately approved critical vendors (payments, identity, ticketing, backups, and email security) all run in the same single region of one hyperscale cloud provider. Each vendor passed its individual assessment. Which risk is the analyst MOST likely to escalate?

Answer: Concentration risk: one shared upstream dependency can cause correlated failures across several critical services, which individual vendor assessments can't see

Concentration risk comes from many relationships depending on one common fourth party or location. You only see it when you look at the portfolio as a whole. Each vendor can be acceptable on its own while the combined exposure (one regional outage taking out payments, identity and backups together) is unacceptable. Lock-in is a different concern, and the individual assessments weren't necessarily wrong.

An organization's contract with a managed security provider includes a large indemnification clause and requires the provider to carry cyber liability insurance. Leadership says this 'transfers' the risk of a breach caused by the provider. Which response BEST reflects sound GRC practice?

Answer: Partly correct. The contract may shift some financial impact, but the organization stays accountable for its data, its regulatory obligations and its reputation, so the residual risk still has to be tracked and owned

Risk transfer through contracts and insurance mainly shifts financial consequences. It does not shift accountability. Regulators, customers and data subjects still hold the organization responsible for protecting the data it entrusted to the third party. The risk stays on the register with a named owner, and the transfer is recorded as a treatment that lowers financial impact, not as removal of the risk.

A cloud service provider supporting an agency's authorized system tells the agency, through continuous monitoring, that it will move its database tier to a new subcontracted data center operator in another country. Under NIST SP 800-37 ongoing authorization concepts, what is the MOST appropriate agency response?

Answer: Treat this as a significant change: assess its effect on the system's security and privacy posture (including data location and supply chain risk), update the risk picture, and have the AO decide whether the current authorization still stands or reauthorization is needed

A new subcontractor in another country changes data residency, jurisdiction and the supply chain. That makes it a significant change that can affect the system's risk posture. Under ongoing authorization, significant changes trigger a security impact analysis and a risk-based decision by the AO, who can keep the authorization, add conditions, or require reauthorization. Automatic revocation goes too far, and waiting for the annual cycle ignores what continuous monitoring is for.

An organization ends its relationship with a marketing analytics vendor that processed customer PII. The vendor confirms that access accounts have been disabled. Which additional offboarding action gives the STRONGEST assurance that third-party risk has actually been closed out?

Answer: Get written certification (with evidence where possible) that all copies of the data, including backups and data held by the vendor's subprocessors, were returned or destroyed as the contract requires, and revoke any remaining API keys, tokens and federated trust relationships

Disabling user accounts doesn't remove the remaining risk. The vendor and its subprocessors may still hold PII in production copies, backups or analytics stores, and non-human credentials like API keys, OAuth tokens and SSO trusts can stay active. Proper offboarding confirms data return or destruction across the whole chain, as the contract requires, and revokes every access path. Archiving records or removing the vendor from inventory early doesn't reduce exposure.