CGRC Third-Party Risk 3

Question 1

Which framework provides specific guidance for managing information security risks in supply chains, particularly relevant to US federal agencies?

Accepted Answer

NIST SP 800-161

Answer

NIST SP 800-161 addresses supply chain risk management (SCRM) practices for federal information systems and organizations.

Question 2

What is 'vendor concentration risk' in the context of third-party risk management?

Accepted Answer

Over-reliance on a single vendor or small group of vendors for critical services

Answer

Vendor concentration risk occurs when an organization depends too heavily on one vendor, meaning a failure or exit by that vendor could severely disrupt operations.

Question 3

Which metric in a vendor SLA is most relevant to operational resilience during a vendor outage?

Accepted Answer

Recovery Time Objective (RTO)

Answer

RTO specifies how quickly a vendor's service must be restored after a disruption, directly affecting organizational resilience.

Question 4

A vendor refuses to allow an on-site audit due to confidentiality concerns. What is the most appropriate compensating measure?

Accepted Answer

Request a third-party audit report such as a SOC 2 Type II

Answer

A SOC 2 Type II report, conducted by an independent auditor, provides assurance of vendor controls when a direct audit is not permitted.

Question 5

Under the FFIEC guidance, financial institutions must assess third-party risk through which phase of the vendor lifecycle?

Accepted Answer

Continuously throughout the entire vendor relationship lifecycle

Answer

FFIEC guidance requires ongoing monitoring and assessment of third-party relationships throughout their entire lifecycle, not just at discrete checkpoints.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Third-Party Risk 3