Information Security and Privacy Risk in Third-Party Relationships Flashcards

When assessing a vendor's information security posture, which document provides the MOST comprehensive view of their control environment?

Answer: A completed Standardized Information Gathering (SIG) questionnaire with supporting evidence

The SIG (developed by Shared Assessments) is the industry-standard questionnaire for third-party information security assessments. It covers dozens of control domains and is designed to be accompanied by supporting evidence. A marketing brochure is promotional, a CEO attestation lacks depth, and ISO 9001 covers quality management — not information security.

A vendor will process personally identifiable information (PII) on behalf of your organization. Which contractual clause is MOST critical from a privacy risk perspective?

Answer: A data processing agreement (DPA) specifying permissible uses and breach notification timelines

A Data Processing Agreement (DPA) is required under most major privacy frameworks (GDPR, CCPA, etc.) when a vendor acts as a data processor. It defines permissible uses of data, security requirements, breach notification obligations, and data subject rights support. This is the foundational privacy contract clause for any PII-handling vendor.

Which of the following BEST describes the difference between a Type I and Type II SOC 2 report?

Answer: Type I assesses control design at a point in time; Type II tests operating effectiveness over a period

A SOC 2 Type I report evaluates whether controls are suitably designed at a specific point in time. A SOC 2 Type II report — preferred by most third-party risk programs — tests whether those controls operated effectively over a defined review period (typically 6–12 months). The Type II provides much stronger assurance because it demonstrates sustained control operation.

Your organization shares customer financial data with a vendor that subsequently suffers a ransomware attack. Under a mature third-party risk program, who bears primary responsibility for notifying affected customers?

Answer: The originating organization, as the data controller, in accordance with applicable regulations

Under most privacy and data protection laws (e.g., GDPR, state breach notification laws), the data controller — the organization that collected the customer data — retains responsibility for breach notification obligations, even when the breach occurs at a vendor (data processor). The contract should require the vendor to promptly notify the controller so that the controller can fulfill its regulatory duties.

Which of the following is a key output of a vendor's penetration test that a third-party risk professional should review?

Answer: An executive summary of vulnerabilities found, their severity ratings, and remediation status

The risk-relevant output of a penetration test is the findings report — specifically the vulnerabilities discovered, their CVSS or similar severity ratings, and whether they have been remediated or mitigated. This allows the third-party risk professional to assess whether the vendor has addressed material weaknesses. Employee lists, invoices, and source code are not standard assessment artifacts.

The principle of 'data minimization' in the context of third-party risk management means:

Answer: Organizations should share only the minimum amount of personal data with vendors that is necessary to fulfill the service

Data minimization is a privacy principle enshrined in GDPR and other regulations requiring that only data strictly necessary for the specified purpose be collected or shared. When applied to third-party relationships, it limits the amount of sensitive data exposed to vendor environments, directly reducing privacy and security risk.