CTPRP Business Continuity and Resiliency Risk

Question 1

What is the PRIMARY purpose of reviewing a vendor's Business Continuity Plan (BCP) during third-party due diligence?

Accepted Answer

To assess whether the vendor can continue delivering services during a disruptive event

Answer

The BCP review is conducted to understand whether a vendor has credible, tested plans for maintaining service delivery — or recovering it rapidly — when faced with disasters, system failures, or other disruptions. This directly protects the client organization from downstream operational risk when a critical vendor is impacted.

Question 2

A vendor states its Recovery Time Objective (RTO) is 4 hours. What does this mean?

Accepted Answer

The vendor commits to restoring services within 4 hours of a declared disaster

Answer

RTO is the maximum acceptable time between a service disruption and the restoration of normal operations. A 4-hour RTO means the vendor commits to having services back up within 4 hours of invoking their disaster recovery plan. It differs from RPO (Recovery Point Objective), which addresses how much data loss is acceptable.

Question 3

Vendor concentration risk occurs when:

Accepted Answer

An organization relies on one vendor (or a small group) for a critical function with no viable alternatives

Answer

Concentration risk arises when dependence on a single vendor — or a few vendors — for a critical service creates an outsized operational risk if that vendor fails, exits the market, or cannot perform. Regulators increasingly require organizations to identify and mitigate concentration risk through diversification strategies or robust contingency plans.

Question 4

Which of the following provides the STRONGEST assurance that a vendor's disaster recovery plan will work when needed?

Accepted Answer

Evidence that the vendor completed a full failover test within the last 12 months

Answer

Documented plans and attestations confirm intent, but only tested plans provide evidence of actual operational effectiveness. A full failover test — where systems actually cut over to backup infrastructure — validates that the plan works in practice. Untested DR plans frequently fail during real events due to undetected gaps.

Question 5

Fourth-party risk refers to:

Accepted Answer

Risk introduced by your vendor's own subcontractors and suppliers

Answer

Fourth parties are the vendors that your vendors rely on — their subcontractors, technology providers, and supply chain partners. A breach or failure at a fourth party can cascade to your third party and then to your organization, even though you have no direct relationship. Mature TPRM programs assess and monitor fourth-party exposure for critical vendors.

(CTPRP) Certified Third Party Risk Professional Practice Test

(CTPRP) Certified Third Party Risk Professional Practice Test

CTPRP Business Continuity and Resiliency Risk