CRISC Third-Party and Vendor Risk Management

Question 1

Which activity is MOST important when onboarding a new critical third-party vendor?

Accepted Answer

Conducting a thorough due diligence risk assessment

Answer

Due diligence risk assessment is essential before onboarding critical vendors to identify security, financial, and operational risks they may introduce.

Question 2

A 'fourth-party risk' in vendor management refers to:

Accepted Answer

Risk from subcontractors or suppliers used by your primary vendors

Answer

Fourth-party risk refers to the risk introduced by vendors that your direct (third-party) vendors rely upon, creating an extended supply chain risk.

Question 3

Which contract provision gives an organization the RIGHT to examine a vendor's controls and compliance posture?

Accepted Answer

Right-to-audit clause

Answer

A right-to-audit clause contractually permits the organization to conduct audits or assessments of the vendor's security controls and compliance.

Question 4

When classifying vendors by risk tier, which factor is MOST relevant to assigning a vendor to the highest risk tier?

Accepted Answer

The volume of sensitive data the vendor accesses or processes

Answer

Vendors who access or process significant volumes of sensitive or regulated data pose the greatest potential impact in a breach, warranting the highest risk tier.

Question 5

What is the PRIMARY purpose of a Service Level Agreement (SLA) in vendor risk management?

Accepted Answer

To set measurable performance and availability expectations that can be monitored

Answer

SLAs define specific, measurable service performance targets, enabling the organization to monitor vendor compliance and hold vendors accountable.

CRISC - Certified in Risk and Information Systems Control Practice Test

CRISC - Certified in Risk and Information Systems Control Practice Test

CRISC Third-Party and Vendor Risk Management