Regulatory Compliance and Vendor Governance Flashcards

Which US regulatory framework requires organizations to report material cybersecurity incidents involving third parties to the SEC within four business days?

Answer: SEC Cybersecurity Disclosure Rules (2023)

The SEC's 2023 Cybersecurity Disclosure Rules require public companies to disclose material cybersecurity incidents, including those originating from third parties, within four business days.

What is the primary risk management objective of requiring vendors to carry cyber liability insurance?

Answer: To transfer a portion of financial risk from a vendor-caused breach to the vendor's insurer

Requiring cyber liability insurance ensures that if a vendor causes a data breach, there is an insurance mechanism to cover associated financial losses, partially transferring that risk away from your organization.

Under FFIEC guidance, what must banks document as part of ongoing third-party relationship management?

Answer: Performance reviews, risk reassessments, and any material changes to the vendor relationship

FFIEC guidance requires banks to document ongoing vendor performance, periodic risk reassessments, and any changes that could affect the risk profile of the third-party relationship.

What is the main purpose of an exit strategy or exit plan for a critical vendor?

Answer: To ensure business continuity if the vendor fails, exits the market, or the contract is terminated

An exit strategy for a critical vendor details how the organization will transition services to maintain continuity if the vendor relationship ends abruptly or is terminated for cause.

Which control is most effective for reducing risk when a vendor has access to your internal network?

Answer: Network segmentation and least-privilege access controls

Network segmentation limits vendor access to only the systems they need, and least-privilege principles ensure they cannot access unrelated sensitive data or critical infrastructure.

What does 'risk appetite' mean in the context of a TPRM program?

Answer: The level of third-party risk an organization is willing to accept in pursuit of its objectives

Risk appetite defines the boundaries within which an organization is willing to operate regarding third-party risk, guiding decisions about which vendors to engage and what risk levels are acceptable.