CTPRP Repertoire and Literature 2

Question 1

Which regulatory guidance document issued by the OCC specifically addresses risk management expectations for bank relationships with third parties?

Accepted Answer

OCC Bulletin 2013-29

Answer

OCC Bulletin 2013-29 provides comprehensive guidance on third-party risk management expectations for national banks and federal savings associations.

Question 2

The NIST Cybersecurity Framework (CSF) core functions most relevant to third-party risk management include all of the following EXCEPT:

Accepted Answer

Innovate

Answer

The NIST CSF five core functions are Identify, Protect, Detect, Respond, and Recover; 'Innovate' is not one of them.

Question 3

ISO/IEC 27036 is the international standard series specifically focused on:

Accepted Answer

Information security for supplier relationships

Answer

ISO/IEC 27036 provides guidance on information security for supplier relationships, making it directly relevant to TPRM practitioners.

Question 4

The Shared Assessments Program's Standardized Information Gathering (SIG) questionnaire is primarily used for:

Accepted Answer

Assessing third-party cybersecurity and operational risk controls

Answer

The SIG questionnaire is a standardized tool designed to assess a vendor's information security, privacy, and operational risk controls.

Question 5

Under the FFIEC IT Examination Handbook on Outsourcing Technology Services, which phase of the vendor management lifecycle requires the most rigorous oversight activities?

Accepted Answer

Ongoing monitoring and management

Answer

The FFIEC handbook emphasizes that ongoing monitoring is critical to ensure third parties continue to meet contractual and regulatory obligations throughout the relationship.

(CTPRP) Certified Third Party Risk Professional Practice Test

(CTPRP) Certified Third Party Risk Professional Practice Test

CTPRP Repertoire and Literature 2