CTPRP Third-Party Risk Assessment and Due Diligence 2

Question 1

Which standard provides a framework for information security management systems and is commonly requested from vendors in due diligence?

Accepted Answer

ISO/IEC 27001

Answer

ISO/IEC 27001 is the internationally recognized standard for information security management systems and is frequently requested as evidence of security controls during vendor due diligence.

Question 2

A SOC 2 Type II report differs from a SOC 2 Type I report in that it:

Accepted Answer

Covers effectiveness of controls over a period of time, not just a point in time

Answer

SOC 2 Type II reports assess the operational effectiveness of controls over a defined review period (typically 6–12 months), whereas Type I assesses controls at a single point in time.

Question 3

What is the key objective of a vendor's Business Continuity Plan (BCP) review during due diligence?

Accepted Answer

To verify the vendor can maintain services during disruptions

Answer

Reviewing a vendor's BCP ensures that the vendor has documented plans to sustain critical services during disruptions, protecting your organization from supply chain interruptions.

Question 4

What is 'concentration risk' in third-party risk management?

Accepted Answer

Over-reliance on a single vendor or a small group of vendors for critical services

Answer

Concentration risk occurs when an organization depends heavily on one or few vendors for critical functions, amplifying the impact if that vendor fails or is disrupted.

Question 5

Which of the following is the best indicator that a vendor's security posture is maturing over time?

Accepted Answer

Demonstrated remediation of previously identified control gaps

Answer

A vendor that consistently remediates identified control gaps over successive assessments demonstrates active improvement and maturing security capabilities.

(CTPRP) Certified Third Party Risk Professional Practice Test

(CTPRP) Certified Third Party Risk Professional Practice Test

CTPRP Third-Party Risk Assessment and Due Diligence 2