CTPRP Regulatory Compliance and Vendor Governance 1

Question 1

Which US federal law requires covered entities and their business associates to safeguard protected health information (PHI) shared with vendors?

Accepted Answer

HIPAA

Answer

HIPAA requires covered entities to enter into Business Associate Agreements (BAAs) with vendors that access or process PHI, establishing mutual data protection obligations.

Question 2

Under the Gramm-Leach-Bliley Act (GLBA), what must financial institutions require from service providers who handle consumer financial data?

Accepted Answer

Contractual safeguards and privacy obligations for consumer data

Answer

GLBA's Safeguards Rule requires financial institutions to contractually obligate service providers to implement appropriate safeguards for customer financial data.

Question 3

What is the primary role of a Third-Party Risk Management (TPRM) policy within an organization?

Accepted Answer

To establish the governance framework, roles, and standards for managing vendor risk

Answer

A TPRM policy defines the governance structure, risk appetite, roles and responsibilities, and minimum standards that guide all third-party risk management activities organization-wide.

Question 4

Which body provides the CTPRP certification and sets the professional standards for third-party risk professionals in the US?

Accepted Answer

Shared Assessments

Answer

Shared Assessments is the organization that administers the CTPRP certification and develops the tools and standards used by third-party risk professionals globally.

Question 5

What is the key purpose of a right-to-audit clause in a vendor contract?

Accepted Answer

To allow the client organization to audit the vendor's controls and compliance

Answer

A right-to-audit clause contractually reserves the client's ability to conduct or commission audits of the vendor's controls, ensuring ongoing accountability beyond self-attestation.

(CTPRP) Certified Third Party Risk Professional Practice Test

(CTPRP) Certified Third Party Risk Professional Practice Test

CTPRP Regulatory Compliance and Vendor Governance 1