CTPRP Information Security and Privacy Risk in Third-Party Relationships

Question 1

When assessing a vendor's information security posture, which document provides the MOST comprehensive view of their control environment?

Accepted Answer

A completed Standardized Information Gathering (SIG) questionnaire with supporting evidence

Answer

The SIG (developed by Shared Assessments) is the industry-standard questionnaire for third-party information security assessments. It covers dozens of control domains and is designed to be accompanied by supporting evidence. A marketing brochure is promotional, a CEO attestation lacks depth, and ISO 9001 covers quality management — not information security.

Question 2

A vendor will process personally identifiable information (PII) on behalf of your organization. Which contractual clause is MOST critical from a privacy risk perspective?

Accepted Answer

A data processing agreement (DPA) specifying permissible uses and breach notification timelines

Answer

A Data Processing Agreement (DPA) is required under most major privacy frameworks (GDPR, CCPA, etc.) when a vendor acts as a data processor. It defines permissible uses of data, security requirements, breach notification obligations, and data subject rights support. This is the foundational privacy contract clause for any PII-handling vendor.

Question 3

Which of the following BEST describes the difference between a Type I and Type II SOC 2 report?

Accepted Answer

Type I assesses control design at a point in time; Type II tests operating effectiveness over a period

Answer

A SOC 2 Type I report evaluates whether controls are suitably designed at a specific point in time. A SOC 2 Type II report — preferred by most third-party risk programs — tests whether those controls operated effectively over a defined review period (typically 6–12 months). The Type II provides much stronger assurance because it demonstrates sustained control operation.

Question 4

Your organization shares customer financial data with a vendor that subsequently suffers a ransomware attack. Under a mature third-party risk program, who bears primary responsibility for notifying affected customers?

Accepted Answer

The originating organization, as the data controller, in accordance with applicable regulations

Answer

Under most privacy and data protection laws (e.g., GDPR, state breach notification laws), the data controller — the organization that collected the customer data — retains responsibility for breach notification obligations, even when the breach occurs at a vendor (data processor). The contract should require the vendor to promptly notify the controller so that the controller can fulfill its regulatory duties.

Question 5

Which of the following is a key output of a vendor's penetration test that a third-party risk professional should review?

Accepted Answer

An executive summary of vulnerabilities found, their severity ratings, and remediation status

Answer

The risk-relevant output of a penetration test is the findings report — specifically the vulnerabilities discovered, their CVSS or similar severity ratings, and whether they have been remediated or mitigated. This allows the third-party risk professional to assess whether the vendor has addressed material weaknesses. Employee lists, invoices, and source code are not standard assessment artifacts.

(CTPRP) Certified Third Party Risk Professional Practice Test

(CTPRP) Certified Third Party Risk Professional Practice Test

CTPRP Information Security and Privacy Risk in Third-Party Relationships