Regulatory Compliance and Vendor Governance Flashcards

Which US federal law requires covered entities and their business associates to safeguard protected health information (PHI) shared with vendors?

Answer: HIPAA

HIPAA requires covered entities to enter into Business Associate Agreements (BAAs) with vendors that access or process PHI, establishing mutual data protection obligations.

Under the Gramm-Leach-Bliley Act (GLBA), what must financial institutions require from service providers who handle consumer financial data?

Answer: Contractual safeguards and privacy obligations for consumer data

GLBA's Safeguards Rule requires financial institutions to contractually obligate service providers to implement appropriate safeguards for customer financial data.

What is the primary role of a Third-Party Risk Management (TPRM) policy within an organization?

Answer: To establish the governance framework, roles, and standards for managing vendor risk

A TPRM policy defines the governance structure, risk appetite, roles and responsibilities, and minimum standards that guide all third-party risk management activities organization-wide.

Which body provides the CTPRP certification and sets the professional standards for third-party risk professionals in the US?

Answer: Shared Assessments

Shared Assessments is the organization that administers the CTPRP certification and develops the tools and standards used by third-party risk professionals globally.

What is the key purpose of a right-to-audit clause in a vendor contract?

Answer: To allow the client organization to audit the vendor's controls and compliance

A right-to-audit clause contractually reserves the client's ability to conduct or commission audits of the vendor's controls, ensuring ongoing accountability beyond self-attestation.

Under GDPR, which role does a vendor typically hold when processing personal data on behalf of a US-based company serving EU residents?

Answer: Data Processor

Under GDPR, a vendor processing personal data solely under the instructions of a client organization is classified as a Data Processor, with specific obligations under Article 28.