CSL CSL Vendor & Third-Party Risk Management 2

Question 1

What is the primary purpose of a Vendor Risk Management (VRM) questionnaire?

Accepted Answer

To assess a vendor's security controls and practices against your requirements

Answer

VRM questionnaires gather information about a vendor's security posture, policies, and controls to assess whether they meet the organization's security standards.

Question 2

Which industry standard framework provides a structure for managing information security risks throughout the supply chain?

Accepted Answer

NIST SP 800-161 (Supply Chain Risk Management)

Answer

NIST SP 800-161 provides guidelines specifically for identifying, assessing, and mitigating cybersecurity risks in supply chains and third-party relationships.

Question 3

An organization is onboarding a new payroll processing vendor. What minimum security requirement should be contractually required?

Accepted Answer

Vendor must demonstrate encryption of data at rest and in transit

Answer

Encryption of data at rest and in transit is a baseline security requirement that protects sensitive payroll data regardless of where it is stored or transmitted.

Question 4

What is the purpose of a concentration risk assessment in vendor management?

Accepted Answer

To identify over-reliance on a single vendor for critical services

Answer

Concentration risk identifies situations where too many critical functions depend on a single vendor, creating a single point of failure that could disrupt operations.

Question 5

How should a cybersecurity leader handle a critical vendor who refuses to complete a security questionnaire?

Accepted Answer

Assess risk using available public information, certifications, and consider alternative vendors

Answer

When a vendor refuses to cooperate, leaders should use available external evidence (SOC reports, certifications, news) to make a risk-based decision and evaluate alternatives.

(CSL) Cybersecurity Leadership Certification Practice Test

(CSL) Cybersecurity Leadership Certification Practice Test

CSL CSL Vendor & Third-Party Risk Management 2