Regulatory Compliance and Vendor Governance Flashcards
6 cards from real CTPRP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Regulatory Compliance and Vendor Governance flashcards as text
Which element of a vendor contract directly defines the performance standards the vendor must meet?
Answer: Service-Level Agreement (SLA)
An SLA specifies measurable performance metrics such as uptime, response time, and resolution times that the vendor is contractually obligated to maintain.
What is the significance of PCI DSS compliance for a vendor handling payment card data?
Answer: It confirms the vendor meets security standards required to store, process, or transmit cardholder data
PCI DSS compliance demonstrates that the vendor has implemented the required controls to protect cardholder data, reducing the payment-related risk to organizations that share card data with them.
In vendor governance, what does 'escalation path' refer to?
Answer: The defined process for raising unresolved vendor issues to higher authority
An escalation path defines the steps and authorities involved when vendor performance issues, control failures, or contractual disputes cannot be resolved at the operational level.
Which committee or group within an organization typically has oversight responsibility for the enterprise third-party risk management program?
Answer: Risk Committee or Third-Party Risk Oversight Committee
A dedicated Risk Committee or Third-Party Risk Oversight Committee provides executive-level governance, ensuring TPRM is aligned with enterprise risk appetite and regulatory expectations.
When a vendor is classified as 'critical,' what additional oversight is typically required beyond standard due diligence?
Answer: Enhanced monitoring, executive engagement, and contingency planning
Critical vendors receive heightened oversight including more frequent assessments, senior-level relationship management, and tested contingency or exit plans due to their impact on business operations.
What does 'vendor offboarding' in a TPRM program primarily ensure?
Answer: That access is revoked and data is returned or destroyed when a vendor relationship ends
Vendor offboarding ensures that all system access is terminated, data obligations are fulfilled (returned or securely destroyed), and residual risks are managed when a vendor relationship concludes.
How this page was made: written with AI tools and published by Nathan Beja, founder of Practice Test Geeks, who is responsible for its content. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy
Sources & references
Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy
- sharedassessments.org — Test delivery, eligibility, fees, exam format, passing score, renewal, retake fee, retake policy, score release, test dates · verified Oct 2026