CSC Third-Party Vendor Compliance 2

Question 1

Which document formally defines the security obligations a vendor must meet before handling your organization's data?

Accepted Answer

Data Processing Agreement

Answer

Business Associate Agreement

Answer

Master Service Agreement

Answer

Security Addendum

Question 2

A vendor's SOC 2 Type II report covers a 12-month period ending six months ago. What is the primary concern?

Accepted Answer

Controls may have changed since the report period ended

Answer

The report is too old to be relevant

Answer

The audit scope may not match your requirements

Answer

SOC 2 Type II reports expire after 3 months

Question 3

What is 'fourth-party risk' in the context of vendor compliance?

Accepted Answer

Risk from a vendor's subcontractors or suppliers

Answer

Risk introduced by four simultaneous vendor audits

Answer

Risk from the fourth tier of internal management

Answer

Risk from vendors operating in four or more countries

Question 4

When should a Vendor Risk Assessment be updated beyond the standard annual cycle?

Accepted Answer

When the vendor announces a material change such as an acquisition or data breach

Answer

Only when a new contract is signed

Answer

Quarterly regardless of changes

Answer

When the vendor's pricing changes

Question 5

A vendor refuses to complete your security questionnaire, citing trade secrets. What is the best response?

Accepted Answer

Request an independent third-party attestation or audit report instead

Answer

Accept the vendor without assessment

Answer

Reduce the questionnaire to only three questions

Answer

Sign a mutual NDA and require full completion

Question 6

Which regulatory framework specifically requires covered entities to have Business Associate Agreements with vendors that handle protected health information?

Accepted Answer

HIPAA

Answer

PCI DSS

Answer

SOX

Answer

NIST CSF

Question 7

What is the purpose of a vendor tiering or classification system in a third-party risk program?

Accepted Answer

To allocate due diligence effort proportionally based on risk level

Answer

To rank vendors by price

Answer

To determine vendor payment priority

Answer

To standardize contract lengths across vendors