CGRC Third-Party Risk 6

Question 1

A federal agency plans to use a SaaS offering that holds a FedRAMP JAB Provisional Authorization (P-ATO) at the Moderate baseline. The agency's ISSO suggests that, because of the P-ATO, the agency can put the service into production without any further authorization action. Which statement BEST describes the agency's actual obligation?

Accepted Answer

The agency's Authorizing Official must still issue an agency ATO, using the FedRAMP package and making sure the controls the customer is responsible for under the Customer Responsibility Matrix are in place

Answer

FedRAMP lets agencies reuse an existing security package so they don't have to repeat the assessment work. It does not move risk acceptance away from the agency. Each agency's AO still has to grant an agency-level ATO, reviewing the SSP, SAR and POA&M and confirming that the customer-responsible controls named in the CRM are implemented. A full re-assessment defeats the purpose of reuse, and the P-ATO comes with no grace period.

Question 2

A prime contractor supplying a mission system relies on a firmware component made by a sub-tier supplier that has no contract with the government agency. Following NIST SP 800-161 Rev. 1 C-SCRM practices, which mechanism is MOST effective at making sure the agency's security requirements actually reach this fourth party?

Accepted Answer

Including flow-down clauses in the prime contract that require the prime to pass equivalent security and notification requirements to its sub-tier suppliers

Answer

The agency has no privity of contract with sub-tier suppliers, so it can only bind them through flow-down clauses. These clauses require the prime to impose equivalent requirements, such as security controls, incident notification and provenance, on its own suppliers. NIST SP 800-161 Rev. 1 stresses flow-down as a key way to extend C-SCRM requirements across the supply chain. A SOC 2 report covers only the prime, scanning a party you have no agreement with is neither feasible nor lawful, and an NDA covers confidentiality, not security requirements.

Question 3

A payroll vendor gives you a clean SOC 2 Type II report. The report states that the vendor's colocation data center provider is presented using the carve-out method. What does this mean for your third-party risk assessment?

Accepted Answer

The data center's controls are excluded from the auditor's testing, so you should review the complementary subservice organization controls (CSOCs) and get separate assurance over the data center

Answer

Under the carve-out method, the subservice organization's controls are left out of the scope of the description and the testing. The report lists the controls the vendor expects the subservice organization to perform (CSOCs). The user entity has to assess those separately, for example by getting the data center's own SOC report. The inclusive method would bring them into scope. Carve-out is a valid, common choice and does not mean exceptions were found.

Question 4

Your critical vendor's most recent SOC 2 Type II report covers a period that ended seven months ago. To cover the gap, the vendor provides a bridge letter. What is the PRIMARY limitation you should record in the risk assessment?

Accepted Answer

The bridge letter is a management representation, not independently tested, so it gives no auditor assurance that controls worked during the gap period

Answer

A bridge (or gap) letter is written and signed by the service organization's management. It states that no material changes to the control environment have happened since the end of the report period. No auditor tests it, so it extends neither the auditor's opinion nor its assurance. It is useful but weaker evidence, and the residual risk for the gap period should be weighed accordingly. Bridge letters are used with both SOC 1 and SOC 2 reports.

Question 5

An authorized information system depends on an external managed security service provider. Mid-cycle, the provider announces it is being acquired by a company with significant foreign ownership. Under an ongoing authorization approach, what is the MOST appropriate response?

Accepted Answer

Treat it as a significant event that triggers a risk reassessment (including foreign ownership, control or influence concerns), and send the results to the AO to decide whether the current authorization is still acceptable

Answer

Under ongoing authorization (NIST SP 800-37 Rev. 2), events that change the risk picture trigger reassessment. They do not cause automatic revocation, and they shouldn't wait for the next scheduled cycle. A change of ownership involving foreign control is a supply chain risk event even when no technical control has changed. The risk is reassessed and the AO decides whether to accept it, add conditions or reauthorize. Automatic revocation skips the AO's risk-based judgment, and contract remedies do not replace risk analysis.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Third-Party Risk 6