CTPRP Regulatory Compliance and Vendor Governance

Question 1

Which US federal law requires covered entities and their business associates to safeguard protected health information (PHI) shared with vendors?

Accepted Answer

HIPAA

Answer

SOX

Answer

GLBA

Answer

FCRA

Question 2

Under the Gramm-Leach-Bliley Act (GLBA), what must financial institutions require from service providers who handle consumer financial data?

Accepted Answer

Contractual safeguards and privacy obligations for consumer data

Answer

Proof of ISO 9001 certification

Answer

Annual charity contributions

Answer

A minimum of 500 employees

Question 3

What is the primary role of a Third-Party Risk Management (TPRM) policy within an organization?

Accepted Answer

To establish the governance framework, roles, and standards for managing vendor risk

Answer

To list approved vendors for procurement teams

Answer

To set employee salary guidelines for risk staff

Answer

To define the organization's marketing strategy for vendor partnerships

Question 4

Which body provides the CTPRP certification and sets the professional standards for third-party risk professionals in the US?

Accepted Answer

Shared Assessments

Answer

ISACA

Answer

ISC2

Answer

CompTIA

Question 5

What is the key purpose of a right-to-audit clause in a vendor contract?

Accepted Answer

To allow the client organization to audit the vendor's controls and compliance

Answer

To give the vendor the right to audit the client's financials

Answer

To permit third-party auditors to review the client's own employees

Answer

To authorize government regulators to inspect vendor facilities on behalf of the client

Question 6

Under GDPR, which role does a vendor typically hold when processing personal data on behalf of a US-based company serving EU residents?

Accepted Answer

Data Processor

Answer

Data Controller

Answer

Data Subject

Answer

Data Custodian