CTPRP Party Practice Questions

Which statement BEST describes the methods of performing due diligence during third party risk assessments?

• AA. Inspecting physical and environmental security controls by conducting a facility tour
• BB. Reviewing status of findings from the questionnaire and defining remediation plans
• CC. interviewing subject matter experts or control owners, reviewing compliance artifacts, and validating controls
• DD. Reviewing and assessing only the obligations that are specifically defined in the contract

The BEST way to manage Fourth-Nth Party risk is:

• AA. Include a provision in the vender contract requiring the vendor to provide notice and obtain written consent before outsourcing any service
• BB. Include a provision in the contract prohibiting the vendor from outsourcing any service which includes access to confidential data or systems
• CC. Incorporate notification and approval contract provisions for subcontracting that require evidence of due diligence as defined by a TPRM program
• DD. Require the vendor to maintain a cyber-insurance policy for any service that is outsourced which includes access to confidential data or systems