CGRC Third-Party Risk 5

Question 1

A vendor provides your organization with a penetration test report conducted on their own systems. What is the primary limitation of this approach?

Accepted Answer

The report may lack independence since the vendor selected and scoped the test

Answer

Vendor-commissioned penetration tests may be scoped to exclude sensitive areas, reducing objectivity; an independent or customer-commissioned test provides greater assurance.

Question 2

Which practice helps organizations detect when a vendor's financial instability could threaten service continuity?

Accepted Answer

Monitoring vendor credit ratings, financial filings, and news alerts

Answer

Monitoring credit ratings, public financial filings, and news provides early warning signals of financial distress that could affect a vendor's ability to deliver services.

Question 3

What is the significance of a 'critical vendor' designation within a TPRM program?

Accepted Answer

The vendor undergoes enhanced due diligence, more frequent assessments, and has contingency plans

Answer

Critical vendors are subject to heightened scrutiny, more frequent risk reassessments, and must have documented contingency or substitution plans due to the impact their failure would have.

Question 4

Which regulatory requirement directly mandates that covered entities ensure their business associates implement appropriate safeguards for protected health information (PHI)?

Accepted Answer

HIPAA Privacy and Security Rules

Answer

HIPAA requires covered entities to obtain satisfactory assurances from business associates — typically via a BAA — that PHI will be appropriately protected.

Question 5

When conducting a vendor risk assessment, which technique provides the most direct evidence of actual control implementation rather than documented policies?

Accepted Answer

Performing an on-site inspection or technical control testing

Answer

On-site inspections and technical testing provide firsthand evidence that controls are actually implemented, rather than relying on the vendor's self-reported documentation.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Third-Party Risk 5