CSC Third-Party Vendor Compliance 2

Question 1

Which document formally defines the security obligations a vendor must meet before handling your organization's data?

Accepted Answer

Data Processing Agreement

Answer

A Data Processing Agreement (DPA) specifically governs how a vendor processes personal or sensitive data and the security controls required.

Question 2

A vendor's SOC 2 Type II report covers a 12-month period ending six months ago. What is the primary concern?

Accepted Answer

Controls may have changed since the report period ended

Answer

A gap between the report period and today means new vulnerabilities or control failures may exist that are not reflected in the report.

Question 3

What is 'fourth-party risk' in the context of vendor compliance?

Accepted Answer

Risk from a vendor's subcontractors or suppliers

Answer

Fourth-party risk refers to the risk that your vendor's own vendors (subcontractors) introduce into your supply chain.

Question 4

When should a Vendor Risk Assessment be updated beyond the standard annual cycle?

Accepted Answer

When the vendor announces a material change such as an acquisition or data breach

Answer

Material changes such as acquisitions, breaches, or major service changes can alter a vendor's risk profile and require immediate reassessment.

Question 5

A vendor refuses to complete your security questionnaire, citing trade secrets. What is the best response?

Accepted Answer

Request an independent third-party attestation or audit report instead

Answer

Third-party attestations such as SOC 2 or ISO 27001 certificates can satisfy due diligence requirements without exposing the vendor's proprietary details.

(CSC) Cybersecurity Compliance Certification Practice Test

(CSC) Cybersecurity Compliance Certification Practice Test

CSC Third-Party Vendor Compliance 2