Theory and Fundamentals Flashcards

Which of the following scenarios best illustrates 'operational risk' arising from a third-party relationship?

Answer: A vendor's data center outage causes the organization's customer-facing systems to go offline

Operational risk from third parties manifests when vendor failures in processes, systems, or people directly disrupt the organization's own operations.

What is the purpose of a 'vendor exit strategy' or 'termination plan' in TPRM?

Answer: To ensure continuity of operations and secure data return or destruction if the vendor relationship ends

A vendor exit strategy ensures the organization can transition services smoothly, recover its data, and maintain business continuity regardless of why the relationship ends.

In TPRM, what is the role of a 'key risk indicator' (KRI)?

Answer: A forward-looking metric that signals increasing risk before an adverse event happens

KRIs are leading indicators that provide early warning signals of rising risk exposure, enabling proactive intervention before risks materialize into losses.

Which principle of information security is most directly threatened when a vendor shares an organization's data with unauthorized subcontractors?

Answer: Confidentiality

Unauthorized disclosure of data to subcontractors violates confidentiality, the principle requiring that information is accessible only to those authorized to access it.

What is the primary distinction between a 'questionnaire-based assessment' and an 'on-site assessment' in vendor due diligence?

Answer: Questionnaires rely on vendor self-attestation; on-site assessments allow direct verification of controls

Questionnaires depend on the vendor's own representations, while on-site assessments enable direct observation and testing of whether stated controls actually exist and function.

How does 'strategic risk' from third parties differ from operational risk in TPRM?

Answer: Strategic risk relates to threats to the organization's long-term goals and competitive position from vendor decisions or failures

Strategic risk from third parties arises when vendor choices, dependencies, or failures undermine the organization's ability to execute its long-term strategy or maintain competitive advantage.

Which of the following best describes the 'risk universe' concept in TPRM program design?

Answer: The complete inventory of all risk categories and scenarios relevant to third-party relationships that the program must address

The risk universe defines the full scope of risk types—operational, financial, compliance, cyber, reputational, and others—that a TPRM program is designed to identify and manage.