CRO Third-Party Risk Assessment 3

Question 1

A risk assessment reveals that two critical vendors share the same data center facility. Which risk type does this PRIMARILY represent?

Accepted Answer

Concentration risk

Answer

Shared infrastructure creates concentration risk because a single facility failure could simultaneously disable multiple critical vendors.

Question 2

Which standard provides a globally recognized framework specifically for information security controls that is commonly used to evaluate third-party vendors?

Accepted Answer

ISO/IEC 27001

Answer

ISO/IEC 27001 is the international standard for information security management systems and is widely used to evaluate vendor security posture.

Question 3

During vendor onboarding, a security assessment reveals that a critical vendor does not encrypt data at rest. What is the MOST appropriate CRO response?

Accepted Answer

Require the vendor to remediate the gap before go-live or escalate for senior risk acceptance

Answer

Identified security gaps should be remediated before go-live; if business need is urgent, unresolved gaps require formal risk acceptance by senior leadership, not just documentation.

Question 4

What is the purpose of a vendor risk tiering model?

Accepted Answer

To allocate due diligence effort proportionally based on potential impact and likelihood of harm

Answer

Risk tiering directs limited oversight resources toward vendors that pose the greatest potential risk, ensuring proportional due diligence.

Question 5

Which scenario BEST illustrates a 'vendor lock-in' risk?

Accepted Answer

Proprietary data formats and migration costs make switching vendors prohibitively expensive

Answer

Vendor lock-in occurs when proprietary systems, data formats, or switching costs prevent an organization from moving to an alternative provider.

(CRO) Chief Risk Officer Certification Practice Test

(CRO) Chief Risk Officer Certification Practice Test

CRO Third-Party Risk Assessment 3