CTPRP Certified Third-Party Risk Professional (CTPRP) Questions and Answers

An enterprise information security policy (EISP) is a management-level document that details the organization’s philosophy, objectives, and expectations regarding information security. It sets the direction, scope, and tone for all security efforts and provides a framework for developing and implementing security programs and controls. According to the web search results from the search_web tool, some of the key elements of an EISP are:

• A statement of the organization’s security vision, mission, and principles that align with its business goals and values123.
• A definition of the organizational structure and accountabilities for oversight, governance, and management of information security, including roles and responsibilities of senior executives, security officers, business units, and users123 .
• A specification of the legal and regulatory compliance requirements and obligations that the organization must adhere to, such as data protection, privacy, and breach notification laws123 .
• A description of the scope and applicability of the EISP, including the types of information, systems, and assets that are covered, and the exclusions or exceptions that may apply123 .
• A declaration of the effective date and date of last review by management, as well as the frequency and criteria for reviewing and updating the EISP to ensure its relevance and adequacy123 .
• A statement of the organization’s risk appetite and tolerance, and the process for identifying, assessing, and treating information security risks123 .
• A provision of the authority and responsibility for implementing, enforcing, monitoring, and auditing the EISP and its related policies, standards, procedures, and guidelines123 .
• A determination of the access control policy and the rules for granting, revoking, and reviewing access rights and privileges to information, systems, and assets123 .
• An organization of the EISP based on an accepted control framework, such as ISO 27001, NIST SP 800-53, or COBIT, that defines the security domains, objectives, and controls that the organization must implement and maintain123 .

However, option C, a statement that security policies should be changed on an annual basis due to technology changes, is not an accurate reflection of an organization’s requirements within an EISP. While technology changes may affect the security environment and the threats and vulnerabilities that the organization faces, they are not the only factor that determines the need for changing security policies. Other factors, such as business changes, legal changes, risk changes, audit findings, incident reports, and best practices, may also trigger the need for reviewing and updating security policies. Therefore, option C is the correct answer, as it is the only one that does not reflect an organization’s requirements within an EISP. References: The following resources support the verified answer and explanation:

• 1: What Is The Purpose Of An Enterprise Information Security Policy?
• 2: Enterprise Information Security Policies and Standards
• 3: Key Elements Of An Enterprise Information Security Policy
• : Enterprise Information Security Policy (EISP) - SANS

End-user device policies are policies that establish the rules and requirements for the use and management of devices that access organizational data, networks, and systems. These policies typically include user obligations that define the responsibilities and expectations of the users regarding the security, privacy, and compliance of the devices they use. According to the web search results from the search_web tool, some common user obligations defined in end-user device policies are:

• A statement specifying the owner of data on the end-user device: This statement clarifies who owns the data stored on the device, whether it is the organization, the user, or a third party. This statement also defines the rights and obligations of the data owner and the data custodian, such as the access, retention, disposal, and protection of the data123.
• A statement that defines the process to remove all organizational data, settings and accounts at offboarding: This statement outlines the steps and procedures that the user must follow to securely erase or transfer all organizational data, settings, and accounts from the device when they leave the organization or change their role. This statement also specifies the roles and responsibilities of the user, the organization, and the device manager in ensuring the proper offboarding of the device143.
• A statement detailing user responsibility in ensuring the security of the end-user device: This statement describes the actions and measures that the user must take to protect the device from unauthorized access, theft, loss, damage, or compromise. This statement may include requirements such as enabling encryption, password, firewall, antivirus, updates, and backups, as well as reporting any incidents or issues related to the device1435.

However, option D, a statement that specifies the ability to synchronize mobile device data with enterprise systems, is not a user obligation defined in end-user device policies. Rather, this statement is a feature or functionality that may be enabled or disabled by the organization or the device manager, depending on the security and compliance needs of the organization. This statement may also be part of a device configuration policy or a mobile device management policy, which are different from end-user device policies. Therefore, option D is the correct answer, as it is the only one that does not reflect a user obligation defined in end-user device policies. References: The following resources support the verified answer and explanation:

• 1: End-User Device Policy | IT Services - University of Chicago
• 4: Device compliance policies in Microsoft Intune | Microsoft Learn
• 2: Basics of an End User Computing Policy - Apparity Blog
• 3: End-User Device Management Standard Operating Procedure
• 5: End-User Devices | Information Security - University of Chicago

Remote access is any connection made to an organization’s internal network and systems from an external source by a device or host. Remote access can enable greater worker flexibility and productivity, but it also poses significant security risks, such as unauthorized access, data leakage, malware infection, or network compromise. Therefore, it is important to evaluate a third party’s use of remote access within their information security policy, which should define the roles, responsibilities, standards, and procedures for remote access.

One of the key components of evaluating a third party’s use of remote access within their information security policy is identifying the use of multifactor authentication. Multifactor authentication is a method of verifying the identity of a remote user by requiring two or more factors, such as something the user knows (e.g., password, PIN), something the user has (e.g., token, smart card), or something the user is (e.g., fingerprint, face). Multifactor authentication enhances the security of remote access by making it harder for attackers to impersonate or compromise legitimate users. According to the NIST Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security1, multifactor authentication should be used for all remote access, especially for high-risk situations, such as accessing sensitive data or privileged accounts.

The other options are not components of evaluating a third party’s use of remote access within their information security policy. Maintaining blocked IP address ranges, reviewing the testing and deployment procedures to networking components, and providing guidelines to configuring ports on a router are all examples of network security controls, but they are not specific to remote access. They may be part of the overall information security policy, but they are not sufficient to assess the security of remote access. References:

• NIST Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security
• How to Implement an Effective Remote Access Policy
• Why Managing Third-Party Access Requires A Better Approach

One of the key objectives of a TPRM program is to identify and mitigate the risks posed by third parties throughout the relationship life cycle. Therefore, measuring the operational performance of implementing a TPRM program requires tracking the effectiveness and efficiency of the risk management processes and activities. Among the four examples given, calculating the average time to remediate identified corrective actions is the most likely to provide meaningful metrics for this purpose. This metric indicates how quickly and consistently the organization and its third parties can resolve the issues and gaps that are discovered during the risk assessment and monitoring phases. It also reflects the level of collaboration and communication between the parties, as well as the alignment of expectations and standards. A lower average time to remediate implies a higher operational performance of the TPRM program, as it demonstrates a proactive and responsive approach to risk management12.

The other three examples are less likely to provide meaningful metrics for measuring the operational performance of implementing a TPRM program, as they do not directly measure the outcomes or impacts of the risk management activities. Logging the number of exceptions to existing due diligence standards may indicate the level of compliance and consistency of the TPRM program, but it does not show how the exceptions are handled or justified. Measuring the time spent by resources for task and corrective action plan completion may indicate the level of effort and resource allocation of the TPRM program, but it does not show how the tasks and plans contribute to the risk reduction or mitigation. Tracking the number of outstanding findings may indicate the level of exposure and vulnerability of the TPRM program, but it does not show how the findings are prioritized or addressed. References:

• 1: 15 KPIs & Metrics to Measure the Success of Your TPRM Program | UpGuard Blog
• 2: Third-Party Risk Management Reporting: What You Need to Know - Venminder

According to the Shared Assessments Certified Third Party Risk Professional (CTPRP) Study Guide, the third party risk assessor’s role is to evaluate the design and operating effectiveness of the third party’s controls based on an industry framework, such as ISO, NIST, COBIT, or COSO1. The assessor’s role is not to provide an opinion on the effectiveness of controls, but rather to report the results of the evaluation in a factual and objective manner2. The assessor’s role is also to conduct discovery with subject matter experts to understand the control environment, to conduct discovery and validate responses from the risk assessment questionnaire by testing or validating controls, and to review compliance artifacts and identify potential control gaps based on evaluation of the presence of control attributes1. These are all true statements that describe the assessor’s role when conducting a controls evaluation using an industry framework.

References:

• 1: Shared Assessments Certified Third Party Risk Professional (CTPRP) Study Guide, page 29
• 2: What is a Third-Party Risk Assessment? — RiskOptics

In the ‘Defense in Depth’ security model, the innermost layer typically focuses on protecting the most sensitive and critical assets, which are often categorized as 'Private internal'. This layer includes security controls and measures that are designed to safeguard the core, confidential aspects of an organization's infrastructure and data. It encompasses controls such as access controls, encryption, and monitoring of sensitive systems and data to prevent unauthorized access and ensure data integrity and confidentiality. The 'Private internal' layer is crucial for maintaining the security of critical information and systems that are essential to the organization's operations and could have the most significant impact if compromised. Implementing robust security measures at this layer is vital for mitigating risks associated with physical access to critical infrastructure and sensitive information.

References:

• Security frameworks and standards, including NIST SP 800-53 (Security and Privacy Controls for Federal Information Systems and Organizations) and the SANS Institute's guidelines on implementing 'Defense in Depth', provide detailed recommendations on securing the innermost layers of an organization's information systems.
• Publications such as "Physical Security Principles" by ASIS International offer insights into best practices for securing the private internal layer, including access control systems, surveillance, and intrusion detection mechanisms.

Application whitelisting is a security technique that allows only authorized applications to run on a device or network, preventing malware or unauthorized software from executing. While this can be a useful security measure, it is not directly related to remote access risk evaluation, which focuses on the security of the connection and the access rights of the remote users. The other options are more relevant to remote access risk evaluation, as they help to monitor, control, and audit the remote access activities and prevent unauthorized or malicious access. References:

• 1: Secure Remote Access: Risks, Auditing, and Best Practices
• 2: 5 Common Vulnerabilities Associated With Remote Access

Termination for cause is the type of contract termination that is most likely to occur after failure to remediate assessment findings. This is because termination for cause is based on a breach of contract by the third-party, such as non-compliance, poor performance, fraud, or misconduct. Failure to remediate assessment findings indicates that the third-party has not met the contractual obligations or expectations of the entity, and thus exposes the entity to increased risk and liability. Termination for cause allows the entity to end the contract immediately or after a notice period, and to seek damages or remedies from the third-party. Termination for cause is different from other types of contract termination, such as:

• Regulatory/supervisory termination, which is triggered by a change in law or regulation that affects the legality or feasibility of the contract.
• Termination for convenience, which is exercised by the entity without any fault or breach by the third-party, usually for strategic or operational reasons.
• Normal termination, which is the natural expiration of the contract term or the completion of the contract scope. References:
• Shared Assessments. (2020). Certified Third Party Risk Professional (CTPRP) Study Guide1
• Fusion Risk Management. (2021). Exit Strategy for Terminating a Third Party2
• Volkov, M. (2016). Third-Party Risk Management – Part 2: Contract Termination3

Asset management is the process of identifying, tracking, and managing the physical and digital assets of an organization. An asset management program is a set of policies, procedures, and tools that help to ensure the optimal use, security, and disposal of assets. According to the Shared Assessments CTPRP Study Guide1, an asset management program should include the following components:

• Asset inventories: A comprehensive and accurate list of all assets owned, leased, or used by the organization, including hardware, software, data, and services. Asset inventories should include connections to external parties, networks, or systems that process data, as this may introduce additional risks and dependencies12.
• Asset owners: A clear assignment of roles and responsibilities for each asset, including an organizational owner who is accountable for the asset throughout its life cycle. Asset owners should ensure that assets are properly maintained, updated, secured, and disposed of in accordance with the organization’s policies and standards13.
• Asset classification: A consistent and objective method of categorizing assets based on their criticality or data sensitivity. Asset classification helps to determine the appropriate level of protection, monitoring, and testing for each asset, as well as the potential impact of asset loss or compromise1 .
• Asset controls: A set of measures and mechanisms that help to safeguard assets from unauthorized access, use, modification, disclosure, or destruction. Asset controls may include physical, technical, administrative, or contractual means, such as locks, encryption, passwords, policies, or agreements1 .

The statement that is least likely to represent a component of an asset management program is D. Asset inventories should track the flow or distribution of items used to fulfill products and Services across production lines. This statement describes a supply chain management function, not an asset management function. Supply chain management is the process of planning, coordinating, and controlling the flow of materials, information, and services from suppliers to customers. Supply chain management may involve some aspects of asset management, such as inventory control, quality assurance, or vendor risk management, but it is not the same as asset management . Asset management focuses on the assets that the organization owns or uses, not the assets that the organization produces or delivers.

References:

• 1: Shared Assessments. (2020). Certified Third Party Risk Professional (CTPRP) Study Guide.
• 2: ISACA. (2019). COBIT 2019 Framework: Governance and Management Objectives. APO03 Manage enterprise architecture.
• 3: ISO. (2018). ISO/IEC 27001:2018 Information technology — Security techniques — Information security management systems — Requirements. Clause 8.1.2 Asset management roles and responsibilities.
• : NIST. (2013). NIST Special Publication 800-53 Revision 4 Security and Privacy Controls for Federal Information Systems and Organizations. RA-2 Security Categorization.
• : NIST. (2013). NIST Special Publication 800-53 Revision 4 Security and Privacy Controls for Federal Information Systems and Organizations. CM-8 Information System Component Inventory.
• : APICS. (2018). APICS Dictionary, 16th edition. Supply chain management.
• : ISACA. (2019). COBIT 2019 Framework: Governance and Management Objectives. APO13 Manage security.

Data classification is the process of categorizing data according to its type, sensitivity, and value to the organization if altered, stolen, or destroyed1. Data classification helps an organization understand the risk level of its data and implement appropriate controls to protect it. Data can be classified into three risk levels: low, moderate, and high23. Low risk data are data that are intended for public disclosure or have no adverse impact on the organization’s mission, safety, finances, or reputation if compromised23. Sanitized customer data used for aggregated profiling are an example of low risk data, as they do not contain any personally identifiable or sensitive information that could be exploited for criminal or other wrongful purposes. Sanitized data are data that have been modified to remove or obscure any confidential or identifying information, such as names, addresses, phone numbers, etc. Aggregated data are data that have been combined or summarized from multiple sources to provide statistical or analytical insights, such as trends, patterns, averages, etc. Sanitized and aggregated data are often used for research, marketing, or business intelligence purposes, and do not pose a significant threat to the organization or the customers if exposed. References:

• 1: What is Data Classification? | Best Practices & Data Types | Imperva
• 2: Data Classification Guideline (1604 GD.01) - Yale University
• 3: Risk Classifications | University IT
• : Data Classification Policy - Shared Assessments
• : What is Data Sanitization? | Definition and Examples | Imperva
• : What is Data Aggregation? | Definition and Examples | Imperva

The risk of increased expense to conduct vendor assessments based on client contractual requirements is the least important factor in defining your risk assessment process for new global third party relationships. This is because the expense of vendor assessments is not a direct risk to your organization’s security, compliance, reputation, or performance, but rather a cost of doing business that can be budgeted and optimized. While vendor assessments are necessary and beneficial, they are not the primary driver of your risk assessment process, which should focus on the potential impact and likelihood of adverse events or incidents involving your third parties. The other factors (B, C, and D) are more important because they directly affect the level of risk exposure and the mitigation strategies for your third parties. For example, natural disasters and physical security risks can disrupt your third party’s operations and service delivery, government regulation and political stability can affect your third party’s compliance and legal obligations, and financial risk can affect your third party’s solvency and reliability. Therefore, these factors should be considered more carefully when defining your risk assessment process. References:

• 1: Third Party Risk Management: Managing Risk | Deloitte US
• 2: What Is Third-Party Risk Management (TPRM)? 2024 Guide | UpGuard
• 3: What is Third-Party Risk Management? | Blog | OneTrust

Application security design standards are a set of principles for software development that address the top application security risks and industry web requirements. They provide guidance on how to design, develop, and deploy secure applications that meet the security objectives of the organization and the expectations of the customers and regulators. Application security design standards cover topics such as secure design principles, threat modeling, encryption, identity and access management, logging and auditing, coding standards and conventions, safe functions, data handling, error handling, third-party components, and testing and validation. Application security design standards help developers avoid common security pitfalls, reduce vulnerabilities, and enhance the quality and reliability of the software. Application security design standards also facilitate the alignment of the software development lifecycle with the third-party risk management framework, by ensuring that security requirements are defined, implemented, verified, and maintained throughout the development process. References:

• Fundamental Practices for Secure Software Development
• Secure Coding Practices
• Secure Software Development Best Practices
• Certified Third Party Risk Professional (CTPRP) Study Guide

Continuous monitoring is a process of collecting and analyzing data on the performance and security of third-party vendors on an ongoing basis. Continuous monitoring helps to identify and mitigate potential risks, such as data breaches, credential exposures, insider fraud/theft, and other cyber incidents, that may affect the organization and its customers. Continuous monitoring can use various techniques, such as monitoring surface, vulnerabilities, passive and active indicators of compromise, and business intelligence.

Passive and active indicators of compromise are examples of continuous monitoring techniques that track the signs of malicious activity or compromise on the third-party vendor’s systems or networks. Passive indicators of compromise are data sources that do not require direct interaction with the target, such as threat intelligence feeds, dark web monitoring, or external scanning. Active indicators of compromise are data sources that require direct interaction with the target, such as penetration testing, malware analysis, or incident response. Both passive and active indicators of compromise can provide valuable information on the current state and potential threats of the third-party vendor’s environment.

The other options are not examples of continuous monitoring techniques that track breach, credential exposure and insider fraud/theft alerts. Monitoring surface is a technique that measures the size and complexity of the third-party vendor’s attack surface, such as the number and type of internet-facing assets, domains, and services. Vulnerabilities are a technique that identifies the weaknesses or flaws in the third-party vendor’s systems or applications that can be exploited by attackers, such as outdated software, misconfigurations, or unpatched bugs. Business intelligence is a technique that analyzes the business performance and reputation of the third-party vendor, such as financial stability, customer satisfaction, or regulatory compliance. References:

• Guide: Continuous Monitoring for Third-Party Risk
• Continuous Monitoring - Third Party Risk Management
• 12 Ongoing Monitoring Best Practices for Third-Party Risk Management

A risk register is a tool that records and tracks the identified risks, their probability, impact, status, and mitigation actions throughout the life cycle of a third-party relationship1. A risk register typically includes the following components2:

• A unique identifier for each risk
• A description of the risk and its source
• A rating or grading of the risk according to a risk assessment table or hierarchy
• An assessment of the impact and likelihood the risk will occur and the possible seriousness
• An outline of proposed mitigation actions and assignment of risk owner
• A status update on the risk and the progress of the mitigation actions
• A target date for resolving the risk or closing the action A vendor inventory is a list of all the third parties that a banking organization engages with, along with relevant information such as the type, scope, and nature of the services provided, the contract terms and conditions, the performance indicators, and the risk ratings3. A vendor inventory is not a component of a risk register, but rather a separate document that supports the planning and due diligence phases of the third-party relationship life cycle. A vendor inventory may be prioritized by contract value, but also by other criteria such as the criticality of the service, the risk level of the vendor, and the strategic importance of the relationship. References:
• 1: Third-Party Risk Management (TPRM): Final Interagency Guidance, KPMG, June 2023
• 2: What Is Third-Party Risk Management (TPRM)? 2024 Guide, UpGuard, January 2024
• 3: Third-Party Risk Management Guidance, OCC Bulletin 2023-29, October 2023
• [4]: Certified Third Party Risk Professional (CTPRP) Study Guide, Shared Assessments, 2023
• [5]: Best Practices Guidance for Third-Party Risk, GARP, February 2023

Vendor classification or risk tiering is a process of categorizing vendors based on the level of security risk they introduce to an organization12. It is a key component of a third-party risk management (TPRM) program, as it helps to prioritize and allocate resources for vendor assessment, monitoring, and remediation12. The statement D is true, as it reflects the first step of vendor classification or risk tiering, which is to determine the inherent risk of each vendor relationship based on the nature, scope, and complexity of the product or service being outsourced3 . Inherent risk is the risk that exists before any controls or mitigating factors are applied3 . By calculating the inherent risk, an organization can assign each vendor to a risk tier that reflects the potential impact and likelihood of a security breach or incident involving the vendor3 .

The other statements are false, as they do not accurately describe the vendor classification or risk tiering process. The statement A is false, as vendor classification and risk tiers are not based on residual risk calculations, but on inherent risk calculations. Residual risk is the risk that remains after controls or mitigating factors are applied3 . Residual risk is used to evaluate the effectiveness of the controls and the need for further action, but not to classify or tier vendors3 . The statement B is false, as vendor classification and risk tiering should be used for all third party relationships, not only for critical ones. Vendor classification and risk tiering helps to identify and prioritize the critical vendors, but also to manage the low and medium risk vendors according to their respective risk profiles12. The statement C is false, as vendor classification and corresponding risk tiers do not utilize the same due diligence standards for controls evaluation based upon policy, but different ones. Due diligence standards are the criteria and methods used to assess the security posture and performance of vendors. Due diligence standards should vary according to the risk tier of the vendor, as higher risk vendors require more rigorous and frequent evaluation than lower risk vendors.

References:

• 1: What is Vendor Tiering? Optimize Your Vendor Risk Management | UpGuard Blog
• 2: Vendor Tiering Best Practices: Categorizing Vendor Risks | UpGuard Blog
• 3: Third-Party Risk Management (TPRM): A Complete Guide - BlueVoyant
• [4]: Supplemental Examination Procedures for Risk Management of Third-Party Relationships
• [5]: Third Party Risk Management: Why It’s Important And What Features To Look For - Expert Insights

The most important next step after receiving a vendor questionnaire is to analyze the responses and identify any gaps, issues, or risks that may pose a threat to the organization or its customers. This analysis should be based on the inherent risk profile of the vendor, the criticality of the service or product they provide, and the applicable regulatory and contractual requirements. The analysis should also highlight any adverse or high priority responses that indicate a lack of adequate controls, policies, or procedures on the vendor’s part. These responses should be prioritized for further validation, testing, or remediation. The analysis should also document any assumptions, limitations, or dependencies that may affect the accuracy or completeness of the vendor’s responses. References:

• Shared Assessments CTPRP Study Guide, Section 4.2.2, page 43
• Third-Party Risk Management: Managing Risk, Section “Assessing and monitoring third-party risk”
• What Is Third-Party Risk Management (TPRM)? 2024 Guide, Section “Third-Party Risk Management Process”

Scoping is a critical step in third party assessments, as it determines the scope and depth of the assessment based on the inherent risk, impact, and complexity of the vendor relationship. Scoping helps to ensure that the assessment is relevant, efficient, and consistent with the outsourcer’s risk appetite and objectives. Scoping also helps to avoid over or under assessing the vendor, which could result in unnecessary costs, delays, or gaps in risk management. Scoping is not a one-time activity, but rather an ongoing process that should be reviewed and updated throughout the vendor lifecycle. Scoping should be aligned with the outsourcer’s third party risk management framework and policies, and follow the best practices and guidelines provided by the Shared Assessments Program and other industry standards. References:

• 1: THIRD PARTY RISK MANAGEMENT TOOLKIT - Shared Assessments, pages 4-6
• 2: How Dynamic Scoping Can Improve Vendor Risk Assessments - ProcessUnity
• 3: Inherent Risk Tiering for Third-Party Vendor Assessments - MindPoint Group

 TPRM program metrics are the indicators that measure the performance, effectiveness, and maturity of the TPRM program. They help to monitor and communicate the progress, achievements, and challenges of the TPRM program to various stakeholders, such as business units, executive management, risk committees, and board of directors. However, the level of reporting and the frequency of changes in TPRM program metrics vary depending on the stakeholder’s role, responsibility, and interest123:

• Business unit: This level of reporting is focused on the operational aspects of the TPRM program, such as the status of vendor assessments, remediation actions, issues, and incidents. The changes in TPRM program metrics at this level are frequent and granular, as they reflect the day-to-day activities and outcomes of the TPRM program.
• Executive management: This level of reporting is focused on the strategic aspects of the TPRM program, such as the alignment with the business objectives, the compliance with the regulatory requirements, the management of the key risks, and the optimization of the resources and costs. The changes in TPRM program metrics at this level are less frequent and more aggregated, as they reflect the overall direction and performance of the TPRM program.
• Risk committee: This level of reporting is focused on the oversight aspects of the TPRM program, such as the evaluation of the risk appetite, the review of the risk profile, the approval of the risk policies, and the escalation of the risk issues. The changes in TPRM program metrics at this level are occasional and more analytical, as they reflect the governance and assurance of the TPRM program.
• Board of Directors: This level of reporting is focused on the advisory aspects of the TPRM program, such as the endorsement of the risk strategy, the awareness of the risk trends, the guidance of the risk culture, and the support of the risk initiatives. The changes in TPRM program metrics at this level are rare and exceptional, as they reflect the high-level and long-term vision and value of the TPRM program.

Therefore, the correct answer is D. Board of Directors, as this is the level of reporting where changes in TPRM program metrics are rare and exceptional. References:

• 1: 15 KPIs & Metrics to Measure the Success of Your TPRM Program | UpGuard
• 2: Third-party risk management metrics: Best practices to enhance your … | Diligent
• 3: TPRM Metrics - Telling Your Risk Story - Shared Assessments | Shared Assessments

Web content accessibility guidelines (WCAG) are a set of standards that aim to make web content more accessible to people with disabilities, such as visual, auditory, cognitive, or motor impairments. While WCAG is a good practice for web development and usability, it is not directly related to web application security. WCAG does not address the common security risks that web applications face, such as injection, broken authentication, misconfiguration, or vulnerable components. Therefore, adhering to WCAG is not a method of securing web applications, unlike the other options. References:

• 4: OWASP Top 10, a standard awareness document for web application security, lists the most critical security risks to web applications and provides best practices to prevent or mitigate them.
• 5: SANS Institute, a leading provider of cybersecurity training and certification, offers a security checklist for web application technologies (SWAT) that covers best practices for error handling, data protection, configuration, authentication, session management, input and output handling, and access control.
• 6: Built In, a platform for tech professionals, provides 13 web application security best practices, such as using a web application firewall, keeping track of APIs, enforcing expected application behaviors, and following the OWASP Top 10.

Remote wipe is a security feature that allows an administrator or a user to remotely erase all the data and settings on a device in case it is lost or stolen. This prevents unauthorized access to sensitive information and reduces the risk of data breaches. Remote wipe is typically used for company-owned devices, as it ensures that no company data remains on the device after it is lost or stolen. Remote wipe also restores the device to its factory settings, making it unusable for the thief or finder. Remote wipe can be performed through various methods, such as using a mobile device management (MDM) solution, a cloud service, or a built-in feature of the device’s operating system. References:

• 1: How to protect your company from data breaches caused by lost or stolen devices
• 2: BYOD vs Company-Owned Devices: How to Maintain Security
• 3: Lost or Stolen Business Device? Here’s What to do Next

Remote monitoring of HVAC, Smoke, Fire, Water, or Power systems best reflects components of an environmental controls testing program. These systems are critical to ensuring the physical security and operational integrity of data centers and IT facilities. Environmental controls testing programs are designed to verify that these systems are functioning correctly and can effectively respond to environmental threats. This includes monitoring temperature and humidity (HVAC), detecting smoke or fire, preventing water damage, and ensuring uninterrupted power supply. Regular testing and monitoring of these systems help prevent equipment damage, data loss, and downtime due to environmental factors.

References:

• Environmental control standards such as ISO/IEC 27001 (Information Security Management) include requirements for the testing and monitoring of physical and environmental security controls.
• The "Data Center Operations Manual" by the Uptime Institute provides detailed guidelines on the testing and maintenance of environmental control systems to ensure the resilience and reliability of data center operations.

 ESG programs are initiatives that aim to improve the environmental, social, and governance performance of a vendor or service provider. ESG programs may be driven by various factors, such as regulatory obligations, customer expectations, stakeholder pressure, industry standards, or company commitments. Therefore, statement B is true and the correct answer is B. Statement A is false because ESG expectations may come from external entities, such as regulators, investors, customers, or civil society. Statement C is false because ESG commitments can be measured both qualitatively and quantitatively, using indicators such as carbon emissions, diversity, ethics, or compliance. Statement D is false because ESG obligations may apply to any company, regardless of its size, ownership, or sector. References:

• Third-party risk management and the ESG agenda
• ESG third-party risk
• The Role of Third-Party Risk Management in ESG Compliance

The onboarding process for new hires is a key part of the third-party risk management program, as it ensures that the right people are hired and trained to perform their roles effectively and securely. One of the best practices for onboarding new hires is to conduct applicant screening, which may include background checks, reference checks, verification of credentials, and assessment of skills and competencies. Applicant screening helps to identify and mitigate potential risks such as fraud, theft, corruption, or data breaches that may arise from hiring unqualified, dishonest, or malicious individuals. Therefore, it is important to wait for the results of applicant screening before onboarding new employees and contractors, as this can prevent costly and damaging incidents in the future.

The other statements are false regarding the onboarding process for new hires. It is necessary to have employees, contractors, and third-party users sign confidentiality or non-disclosure agreements, as this protects the company’s sensitive information and intellectual property from unauthorized disclosure or misuse. Non-compete agreements may not be required for all job roles, as they may limit the employee’s ability to work for other companies or in the same industry after leaving the current employer. They may also be subject to legal challenges depending on the jurisdiction and the scope of the agreement. Security and privacy awareness training is essential for all new employees and contractors, regardless of their existing certifications, as it educates them on the company’s policies, procedures, and standards for protecting data and systems from cyber threats. It also helps to foster a culture of security and compliance within the organization. References:

• 5 Steps to Effective Third-Party Onboarding
• Using a third-party onboarding tool to address new challenges in third-party risk
• Onboarding and terminating third parties
• CTPRP Job Guide

When calculating residual risk, the best practice for an assessor is to adjust the vendor risk rating based on the changes to the risk level after analyzing the findings and considering the effectiveness of mitigating controls. Residual risk refers to the level of risk that remains after controls are applied to mitigate the initial (inherent) risk. By evaluating the findings from a third-party assessment and factoring in the mitigating controls implemented by the vendor, the assessor can more accurately determine the remaining risk level. This adjusted risk rating provides a more realistic view of the vendor's risk profile, aiding in informed decision-making regarding risk management and vendor oversight.

References:

• The concept of residual risk calculation is discussed in risk management frameworks such as ISO 31000 (Risk Management - Guidelines), which guides the assessment and treatment of risks.
• The "Third-Party Risk Management Guide" by ISACA outlines the process of assessing and managing risks associated with third parties, including the calculation of residual risk.

Vendor management is the process of coordinating with vendors to ensure excellent service to your customers12. It involves activities such as selecting vendors, negotiating contracts, controlling costs, reducing vendor-related risks and ensuring service delivery12. One of the key activities of vendor management is managing service level agreements (SLAs), which are contracts that define the expectations and obligations of both parties regarding the quality, quantity, and timeliness of the goods or services provided3. SLAs help to monitor and measure vendor performance, identify and resolve issues, and enforce penalties or rewards based on the agreed-upon metrics3. The other options are not correct because they do not reflect the concept of vendor management as a whole, but rather specific aspects or tools of vendor management. Scanning and collecting information from third party web sites, reviewing and analyzing external audit reports, and receiving and analyzing a vendor’s response to a questionnaire are all examples of methods or sources of information that can be used to conduct vendor due diligence, risk assessment, or performance evaluation, but they are not the only or the most important activities of vendor management. References:

• What is Vendor Management? Definition, Process, and Tools
• What is vendor management? | Definition & Process | Taulia
• Essential Guide to Vendor Management | Smartsheet, section “Service Level Agreements”

A data flow diagram (DFD) is a graphical representation of the flow of information between outsourcers and third parties, as well as within a system or process. It shows the sources and destinations of data, the processes that transform data, the data stores that hold data, and the data flows that connect them. A DFD can help to understand and refine the business processes or systems that involve data exchange with external entities. A DFD can also help to identify potential risks and vulnerabilities in the data flows, such as data leakage, data corruption, data loss, or unauthorized access.

The other options are incorrect because they do not match the definition of a visual representation of data flows. A configuration standard (A) is a set of rules or guidelines that define how a system or process should be configured, such as hardware, software, or network settings. An audit log report (B) is a record of the activities or events that occurred in a system or process, such as user actions, system changes, or security incidents. A network diagram © is a graphical representation of the physical or logical connections between devices or nodes in a network, such as routers, switches, servers, or computers. References:

https://www.visual-paradigm.com/tutorials/data-flow-diagram-dfd.jsp

https://www.lucidchart.com/pages/data-flow-diagram

This statement does not reflect current practice in addressing fourth party risk or subcontracting risk because it is not sufficient to rely on external audit reports alone. Outsourcers should also perform their own due diligence and monitoring of the subcontractors, as well as ensure that the third party has a robust TPRM program in place. External audit reports may not cover all the relevant aspects of subcontracting risk, such as data security, compliance, performance, and quality. Moreover, external audit reports may not be timely, accurate, or consistent, and may not reflect the current state of the subcontractor’s operations. Therefore, outsourcers should adopt a more proactive and comprehensive approach to managing subcontracting risk, rather than relying on external audit reports. References:

• Shared Assessments Program, page 13: “Outsourcers should not rely solely on external audit reports to address subcontracting risk. Outsourcers should also inspect the vendor’s TPRM program and require evidence of the assessments of subcontractors.”
• Five Best Practices to Manage and Control Third-Party Risk, page 3: "Restricting privileged accounts

According to the NIST Computer Security Incident Handling Guide1, one of the first steps in responding to an incident is to identify the scope, nature, and source of the incident. This involves gathering evidence, analyzing logs, interviewing witnesses, and performing forensic analysis. The goal is to determine the extent of the compromise, the type of attack, the identity or location of the attacker, and the potential impact on the organization and its stakeholders. This step is essential for containing the incident, mitigating the damage, and preventing further escalation or recurrence. References:

• NIST Computer Security Incident Handling Guide1, Section 3.2.2 Identification
• Cisco What Is an Incident Response Plan for IT?2, Section 2. Respond
• CrowdStrike Incident Response [Beginner’s Guide]3, Section 3. Incident Response Steps

The frequency of cyclical assessments is one of the key factors that determines the effectiveness and efficiency of a TPRM program. Cyclical assessments are periodic reviews of the vendor’s performance, compliance, and risk posture that are conducted after the initial onboarding assessment. The frequency of cyclical assessments should be aligned with the organization’s risk appetite and tolerance, and should reflect the level of risk and criticality of the vendor to the organization’s operations. A common approach to determine the frequency of cyclical assessments is to use a vendor risk score, which is a numerical value that represents the vendor’s inherent and residual risk based on various criteria, such as the type, scope, and complexity of the services or products provided, the vendor’s security and privacy controls, the vendor’s compliance with relevant regulations and standards, the vendor’s past performance and incident history, and the vendor’s business continuity and disaster recovery capabilities. The vendor risk score can be used to categorize the vendors into different risk tiers, such as high, medium, and low, and assign appropriate frequencies for cyclical assessments, such as annually, biannually, or quarterly. For example, a high-risk vendor may require an annual assessment, while a low-risk vendor may require a biannual or quarterly assessment. The vendor risk score and the frequency of cyclical assessments should be reviewed and updated regularly to account for any changes in the vendor’s risk profile or the organization’s risk appetite.

The other three statements do not best reflect the factors that help you determine the frequency of cyclical assessments, as they are either too rigid, too vague, or too reactive. Statement A implies that vendor assessments are only necessary during onboarding and can be replaced by continuous monitoring afterwards. However, continuous monitoring alone is not sufficient to ensure the vendor’s compliance and risk management, as it may not capture all the aspects of the vendor’s performance and risk posture, such as contractual obligations, service level agreements, audit results, and remediation actions. Therefore, vendor assessments should be conducted during onboarding and at regular intervals thereafter, complemented by continuous monitoring. Statement C suggests that vendor assessments should be scheduled based on the type of services or products provided, without considering the other factors that may affect the vendor’s risk level and criticality, such as the vendor’s security and privacy controls, the vendor’s compliance with relevant regulations and standards, the vendor’s past performance and incident history, and the vendor’s business continuity and disaster recovery capabilities. Therefore, statement C is too vague and does not provide a clear and consistent basis for determining the frequency of cyclical assessments. Statement D indicates that vendor assessment frequency may need to be changed if the vendor has disclosed a data breach, implying that the frequency of cyclical assessments is only adjusted in response to a negative event. However, this approach is too reactive and may not prevent or mitigate the impact of the data breach, as the vendor’s risk level and criticality may have already increased before the data breach occurred. Therefore, statement D does not reflect a proactive and risk-based approach to determining the frequency of cyclical assessments. References:

• Third-Party Risk Management 101: Guiding Principles
• Mastering the TPRM Lifecycle
• Third Party Risk Management Maturity Assessment

Terms for return or destruction of data should be defined and agreed upon during contract negotiation, as this is the phase where the organization and the third party establish the expectations, obligations, and responsibilities for the relationship, including the handling of data. According to the Shared Assessments CTPRP Study Guide, contract negotiation is the phase where "the organization and the third party negotiate and execute a contract that clearly defines the expectations and responsibilities of both parties, including the scope of work, service level agreements, performance measures, reporting requirements, compliance obligations, security and privacy controls, incident response procedures, dispute resolution mechanisms, termination rights, and other relevant terms and conditions."1 One of the key contractual terms that should be addressed is the return or destruction of data, which specifies how the third party will return or dispose of the organization’s data at the end of the relationship, or upon request, in a secure and timely manner. This term is important for ensuring the organization’s data protection, confidentiality, and compliance, as well as reducing the risk of data breaches, leaks, or misuse by the third party or unauthorized parties.

The other phases of the TPRM lifecycle are not the best choices for defining and agreeing upon terms for return or destruction of data, because:

• B. At third party selection and initial due diligence: This is the phase where the organization identifies, evaluates, and selects the third party that best meets its needs, objectives, and risk appetite. This phase involves conducting due diligence on the third party’s capabilities, qualifications, reputation, performance, security, and compliance, as well as assessing the inherent risk of the relationship. While this phase is important for screening and choosing the right third party, it does not involve defining and agreeing upon the specific terms and conditions of the relationship, such as the return or destruction of data, which are usually done in the contract negotiation phase.
• C. When deploying ongoing monitoring: This is the phase where the organization monitors and reviews the third party’s performance, service delivery, risk management, and compliance on a regular basis, as well as identifies and addresses any issues, gaps, or changes that may arise during the relationship. This phase involves collecting and analyzing data and information from various sources, such as reports, audits, assessments, surveys, feedback, incidents, and metrics, as well as communicating and collaborating with the third party to ensure alignment and improvement. While this phase is important for ensuring the quality and security of the relationship, it does not involve defining and agreeing upon the terms and conditions of the relationship, such as the return or destruction of data, which are usually done in the contract negotiation phase.
• D. At termination and exit: This is the phase where the organization terminates and exits the relationship with the third party, either by mutual agreement, expiration of contract, breach of contract, or other reasons. This phase involves executing the termination and exit plan, which may include notifying the third party, transferring or discontinuing the services, settling the financial obligations, returning or destroying the data, revoking the access rights, and conducting a post-termination review. While this phase is important for ensuring a smooth and secure transition and closure of the relationship, it does not involve defining and agreeing upon the terms and conditions of the relationship, such as the return or destruction of data, which are usually done in the contract negotiation phase.

References:

• 1: Shared Assessments CTPRP Study Guide, page 59, section 5.1: TPRM Lifecycle
• : Third-Party Risk Management: Vendor Contract Terms and Conditions, section: Data Ownership, Return and Destruction
• : [Third-Party Risk Management: The 3rd Party Ecosystem: How to Manage the Risk While Keeping the Benefit], section: Contract Negotiation
• : [Third-Party Risk Management: The 3rd Party Ecosystem: How to Manage the Risk While Keeping the Benefit], section: Termination and Exit

An emergency response plan (ERP) is a document that outlines the procedures and actions to be taken by an organization in the event of a disruptive incident that threatens its operations, assets, reputation, or stakeholders1. An ERP should be aligned with the organization’s business continuity and disaster recovery plans, and should cover the roles and responsibilities, communication channels, escalation processes, resources, and recovery strategies for different types of emergencies2.

The first step in developing an ERP is to conduct an assessment that includes an inventory of the types of events that have the greatest potential to trigger an ERP3. This assessment should consider the likelihood and impact of various scenarios, such as natural disasters, cyberattacks, pandemics, civil unrest, terrorism, or supply chain disruptions, and identify the critical functions, processes, assets, and dependencies that could be affected by these events4. The assessment should also evaluate the existing capabilities and gaps in the organization’s preparedness and response, and prioritize the areas that need improvement or enhancement5. The assessment should be based on a comprehensive risk analysis and a business impact analysis, and should involve input from relevant stakeholders, such as senior management, business units, IT, security, legal, compliance, human resources, and third parties.

The other options are not the first step in developing an ERP, but rather subsequent or complementary steps that should be performed after the initial assessment. Considering work-from-home parameters, incorporating periodic crisis management team tabletop exercises, and using the results of continuous monitoring tools are all important aspects of an ERP, but they are not the starting point for creating one. These steps should be based on the findings and recommendations of the assessment, and should be updated and tested regularly to ensure the effectiveness and relevance of the ERP. References: 1: What is an Emergency Response Plan? | IBM 2: Emergency Response Plan | Ready.gov 3: 8 Steps to Building a Third-Party Incident Response Plan | Prevalent 4: How to create an effective business continuity plan | CIO 5: Emergency Response Planning: 4 Steps to Creating a Plan : Third-Party Risk Management: Final Interagency Guidance : Improving Third-Party Incident Response | Prevalent

In IT asset end-of-life (EOL) processes, the requirement to conduct periodic risk assessments specifically to determine end-of-life is not typically included. EOL processes generally focus on managing the decommissioning and secure disposal of IT assets that have reached the end of their useful life or support period. This includes tracking the status of assets, managing updates and support for third-party systems and applications, and establishing procedures for the secure destruction of assets at sunset. While risk assessments are crucial in overall IT asset management, they are not usually a direct component of determining an asset's EOL status, which is more often based on operational effectiveness, manufacturer support, and technological obsolescence.

References:

• IT asset management and disposal best practices, such as those outlined in the NIST Guidelines for Media Sanitization (NIST SP 800-88), focus on the secure and environmentally responsible disposal of IT assets without specifically mandating periodic risk assessments for EOL determination.
• The "IT Asset Disposal (ITAD) Best Practice Guide" by the International Association of IT Asset Managers (IAITAM) provides insights into effective EOL processes, including tracking, updating, and securely destroying IT assets.

Business Continuity or Disaster Recovery (BC/DR) plans are designed to ensure the continuity of critical business functions and processes in the event of a disruption or disaster. BC/DR plans should include annual testing activities to validate the effectiveness and readiness of the plans, as well as to identify and address any gaps or weaknesses. Testing activities should cover the three main areas of BC/DR: people, processes, and technology12.

The four options given in the question represent different types of testing activities that may be included in the BC/DR plans. However, option D is the least likely to be included, as it is not a mandatory or common practice for most organizations. While it is beneficial to involve third party service providers in the BC/DR testing, as they may play a vital role in the recovery process, it is not a requirement or a standard for most industries. Third party service providers may have their own BC/DR plans and testing schedules, which may not align with the organization’s plans and objectives. Moreover, requiring their participation in industry exercises may pose challenges in terms of coordination, confidentiality, and cost34.

Therefore, option D is the correct answer, as it is the least likely to be included in the annual testing activities for BC/DR plans. The other options are more likely to be included, as they are essential for ensuring the availability and functionality of the technology, processes, and personnel that support the critical business operations. These options are:

• A. Plans to enable technology and business operations to be resumed at a back-up site. This is a common testing activity that involves simulating a disaster scenario that affects the primary site and activating the back-up site to resume the operations. This tests the technical infrastructure, data backup and recovery, and operational procedures of the BC/DR plan12.
• B. Process to validate that specific databases can be accessed by applications at the designated location. This is a common testing activity that involves verifying that the data and applications that are critical for the business functions are accessible and functional at the recovery location. This tests the data integrity, security, and compatibility of the BC/DR plan12.
• C. Ability for business personnel to perform their functions at an alternate work space location. This is a common testing activity that involves relocating the key staff to an alternate location and having them perform their normal duties. This tests the communication, coordination, and productivity of the BC/DR plan12.

References:

• 1: How to Test a Business Continuity Disaster Recovery (BCDR) Plan
• 2: Business Continuity or Disaster Recovery Testing and Training Guidelines
• 3: Third Party Risk Management and Business Continuity Planning
• 4: Third Party Risk Management: Business Continuity and Disaster Recovery

 Questionnaires are one of the most common and effective tools for conducting third party risk assessments. They help organizations gather information about the security and compliance practices of their vendors and service providers, as well as identify any gaps or weaknesses that may pose a risk to the organization. However, not all questionnaires are created equal. Depending on the nature and scope of the third party relationship, different types and levels of questions may be required to adequately assess the risk. Therefore, it is important to configure the assessment questionnaires based on the risk rating and type of service being evaluated12.

The risk rating of a third party is determined by various factors, such as the criticality of the service they provide, the sensitivity of the data they handle, the regulatory requirements they must comply with, and the potential impact of a breach or disruption on the organization. The higher the risk rating, the more detailed and comprehensive the questionnaire should be. For example, a high-risk third party that processes personal or financial data may require a questionnaire that covers multiple domains of security and privacy, such as data protection, encryption, access control, incident response, and audit. A low-risk third party that provides a non-critical service or does not handle sensitive data may require a questionnaire that covers only the basic security controls, such as firewall, antivirus, and password policy12.

The type of service that a third party provides also influences the configuration of the questionnaire. Different services may have different security and compliance standards and best practices that need to be addressed. For example, a third party that provides cloud-based services may require a questionnaire that covers topics such as cloud security architecture, data residency, service level agreements, and disaster recovery. A third party that provides software development services may require a questionnaire that covers topics such as software development life cycle, code review, testing, and vulnerability management12.

By configuring the assessment questionnaires based on the risk rating and type of service being evaluated, organizations can ensure that they ask the right questions to the right third parties, and obtain relevant and meaningful information to support their risk management decisions. Therefore, the statement that assessment questionnaires should be configured based on the risk rating and type of service being evaluated is TRUE12. References: 1: How to Use SIG Questionnaires for Better Third-Party Risk Management 2: Third-party risk assessment questionnaires - KPMG India