Third-Party Risk Assessment and Due Diligence Flashcards

Which standard provides a framework for information security management systems and is commonly requested from vendors in due diligence?

Answer: ISO/IEC 27001

ISO/IEC 27001 is the internationally recognized standard for information security management systems and is frequently requested as evidence of security controls during vendor due diligence.

A SOC 2 Type II report differs from a SOC 2 Type I report in that it:

Answer: Covers effectiveness of controls over a period of time, not just a point in time

SOC 2 Type II reports assess the operational effectiveness of controls over a defined review period (typically 6–12 months), whereas Type I assesses controls at a single point in time.

What is the key objective of a vendor's Business Continuity Plan (BCP) review during due diligence?

Answer: To verify the vendor can maintain services during disruptions

Reviewing a vendor's BCP ensures that the vendor has documented plans to sustain critical services during disruptions, protecting your organization from supply chain interruptions.

What is 'concentration risk' in third-party risk management?

Answer: Over-reliance on a single vendor or a small group of vendors for critical services

Concentration risk occurs when an organization depends heavily on one or few vendors for critical functions, amplifying the impact if that vendor fails or is disrupted.

Which of the following is the best indicator that a vendor's security posture is maturing over time?

Answer: Demonstrated remediation of previously identified control gaps

A vendor that consistently remediates identified control gaps over successive assessments demonstrates active improvement and maturing security capabilities.

When evaluating a cloud vendor's data security controls, which document best details where and how customer data is stored and processed?

Answer: Data Processing Agreement (DPA)

A Data Processing Agreement specifies the roles, responsibilities, and obligations for how the vendor will process, store, and protect customer data in compliance with applicable regulations.