Third-Party Risk Flashcards

A federal agency plans to use a SaaS offering that holds a FedRAMP JAB Provisional Authorization (P-ATO) at the Moderate baseline. The agency's ISSO suggests that, because of the P-ATO, the agency can put the service into production without any further authorization action. Which statement BEST describes the agency's actual obligation?

Answer: The agency's Authorizing Official must still issue an agency ATO, using the FedRAMP package and making sure the controls the customer is responsible for under the Customer Responsibility Matrix are in place

FedRAMP lets agencies reuse an existing security package so they don't have to repeat the assessment work. It does not move risk acceptance away from the agency. Each agency's AO still has to grant an agency-level ATO, reviewing the SSP, SAR and POA&M and confirming that the customer-responsible controls named in the CRM are implemented. A full re-assessment defeats the purpose of reuse, and the P-ATO comes with no grace period.

A prime contractor supplying a mission system relies on a firmware component made by a sub-tier supplier that has no contract with the government agency. Following NIST SP 800-161 Rev. 1 C-SCRM practices, which mechanism is MOST effective at making sure the agency's security requirements actually reach this fourth party?

Answer: Including flow-down clauses in the prime contract that require the prime to pass equivalent security and notification requirements to its sub-tier suppliers

The agency has no privity of contract with sub-tier suppliers, so it can only bind them through flow-down clauses. These clauses require the prime to impose equivalent requirements, such as security controls, incident notification and provenance, on its own suppliers. NIST SP 800-161 Rev. 1 stresses flow-down as a key way to extend C-SCRM requirements across the supply chain. A SOC 2 report covers only the prime, scanning a party you have no agreement with is neither feasible nor lawful, and an NDA covers confidentiality, not security requirements.

A payroll vendor gives you a clean SOC 2 Type II report. The report states that the vendor's colocation data center provider is presented using the carve-out method. What does this mean for your third-party risk assessment?

Answer: The data center's controls are excluded from the auditor's testing, so you should review the complementary subservice organization controls (CSOCs) and get separate assurance over the data center

Under the carve-out method, the subservice organization's controls are left out of the scope of the description and the testing. The report lists the controls the vendor expects the subservice organization to perform (CSOCs). The user entity has to assess those separately, for example by getting the data center's own SOC report. The inclusive method would bring them into scope. Carve-out is a valid, common choice and does not mean exceptions were found.

Your critical vendor's most recent SOC 2 Type II report covers a period that ended seven months ago. To cover the gap, the vendor provides a bridge letter. What is the PRIMARY limitation you should record in the risk assessment?

Answer: The bridge letter is a management representation, not independently tested, so it gives no auditor assurance that controls worked during the gap period

A bridge (or gap) letter is written and signed by the service organization's management. It states that no material changes to the control environment have happened since the end of the report period. No auditor tests it, so it extends neither the auditor's opinion nor its assurance. It is useful but weaker evidence, and the residual risk for the gap period should be weighed accordingly. Bridge letters are used with both SOC 1 and SOC 2 reports.

An authorized information system depends on an external managed security service provider. Mid-cycle, the provider announces it is being acquired by a company with significant foreign ownership. Under an ongoing authorization approach, what is the MOST appropriate response?

Answer: Treat it as a significant event that triggers a risk reassessment (including foreign ownership, control or influence concerns), and send the results to the AO to decide whether the current authorization is still acceptable

Under ongoing authorization (NIST SP 800-37 Rev. 2), events that change the risk picture trigger reassessment. They do not cause automatic revocation, and they shouldn't wait for the next scheduled cycle. A change of ownership involving foreign control is a supply chain risk event even when no technical control has changed. The risk is reassessed and the AO decides whether to accept it, add conditions or reauthorize. Automatic revocation skips the AO's risk-based judgment, and contract remedies do not replace risk analysis.

Under NIST SP 800-47 Rev. 1, two organizations will exchange sensitive data through a dedicated system-to-system connection. Which agreement is MOST appropriate for documenting the technical security requirements of the connection, such as data flows, ports and protocols, encryption, and security incident points of contact?

Answer: Interconnection Security Agreement (ISA)

An ISA is the information exchange agreement that records the technical and security details of a system interconnection: topology, data flows, services and ports, encryption, and security roles and contacts. An MOU/A covers the business and management terms, such as purpose, responsibilities and cost, and often accompanies the ISA without replacing it. An SLA covers performance and availability, and an NDA covers confidentiality obligations.