CGRC Third-Party Risk 2

Question 1

Which document formally establishes the security and compliance obligations a vendor must meet before onboarding?

Accepted Answer

Third-Party Security Questionnaire

Answer

A Third-Party Security Questionnaire collects information about a vendor's security controls and compliance posture prior to onboarding.

Question 2

A vendor stores customer PII on behalf of your organization. Under GDPR, what role does this vendor hold?

Accepted Answer

Data Processor

Answer

Under GDPR, a party that processes personal data on behalf of another is classified as a Data Processor.

Question 3

What is the primary goal of a fourth-party risk assessment?

Accepted Answer

Assessing risks introduced by your vendors' own suppliers

Answer

Fourth-party risk assessment focuses on the subcontractors and suppliers used by your direct vendors, extending the risk visibility beyond the immediate third party.

Question 4

Which activity is most important when a high-risk vendor relationship is terminated?

Accepted Answer

Ensuring data is returned or securely destroyed per contract terms

Answer

Offboarding a high-risk vendor must include verified data return or destruction to prevent unauthorized retention of sensitive information.

Question 5

A TPRM program assigns vendors to risk tiers. Which factor most directly determines a vendor's initial risk tier?

Accepted Answer

Criticality of services provided and data access level

Answer

Risk tiering is primarily driven by the sensitivity of data accessed and the criticality of services the vendor delivers to operations.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Third-Party Risk 2