Third-Party Risk Management (Security+) Vendor Assessment

1. What is a 'critical vendor' in risk management terms?

Any vendor that provides products

A vendor whose failure would significantly impact business operations

A vendor that is the cheapest option

A vendor located overseas

2. Which governance framework emphasizes managing IT risks, including third-party risks?

COBIT

ITIL

Six Sigma

Agile methodology

3. What should happen if a vendor fails to meet agreed security requirements?

Immediately terminate the contract

Implement remediation steps and monitor progress

Ignore the issue if services are still functional

Publicly announce the vendor's failure

4. Which approach reduces risk when dealing with critical vendors?

Using a single vendor for all services

Maintaining backup vendors or redundancy plans

Avoiding written contracts

Limiting vendor access to systems

5. True or False: A vendor's ISO 27001 certification guarantees absolute security with no additional risk.

True

False

6. What is the purpose of a vendor risk scorecard?

To rank vendors by price alone

To quantify and track vendor risk across multiple dimensions

To eliminate all low-cost vendors

To reduce the number of vendors used

7. Which of the following should be evaluated during vendor security assessments?

Data encryption and access controls

Incident response capabilities

Business continuity and disaster recovery plans

All of the above

8. What does 'vendor lock-in' refer to in risk management?

Physical security measures at vendor facilities

A situation where switching vendors becomes difficult or costly

Vendor employee background checks

Encryption of vendor data

9. True or False: Third-party risk assessments should only occur at the beginning of a vendor relationship.

True

False

10. Which contractual clause protects your organization if a vendor experiences a data breach?

Indemnification clause

Non-disclosure agreement

Service level agreement

Confidentiality clause

11. What is the primary goal of Third-Party Risk Management in a security program?

To reduce vendor costs

To identify and mitigate risks from external suppliers and partners

To eliminate all vendor relationships

To transfer all security responsibility to vendors

12. Which metric helps assess a vendor's financial stability and ability to maintain services?

Employee turnover rate

Credit rating and financial statements

Marketing budget

Office location

13. What is the purpose of continuous vendor monitoring?

To ensure compliance with initial agreements and detect emerging risks

To control vendor pricing

To eliminate competition

To reduce audit costs

14. True or False: A vendor's compliance with one security standard eliminates the need for additional risk assessments.

True

False

15. What should be included in a vendor risk management policy?

Vendor selection criteria and ongoing monitoring procedures

Incident response procedures for vendor breaches

Contract termination clauses for security violations

All of the above

16. Which of the following is a key component of vendor due diligence?

Background checks on vendor executives

Review of security certifications and compliance status

Assessment of data handling and storage practices

All of the above

17. What is a 'supply chain attack'?

A vendor raising prices unexpectedly

An attacker compromising a vendor to gain access to downstream customers

A dispute between multiple suppliers

A vendor's failure to deliver on time

18. Which framework is commonly used for assessing third-party cybersecurity risks?

NIST Cybersecurity Framework

ISO 27001

COBIT

All of the above

19. What does a Service Level Agreement (SLA) typically define in vendor contracts?

Expected performance standards and penalties for non-compliance

The vendor's profit margins

Marketing strategies only

Employee vacation policies

20. Which assessment method directly evaluates a vendor's security controls and practices on-site?

Questionnaire review

On-site audit

Compliance certification check

Financial analysis

Vendor Risk Quiz: Can You Vet the Supplier?

1. What is a 'critical vendor' in risk management terms?

2.

What first name or nickname would you like us to use?

2. Which governance framework emphasizes managing IT risks, including third-party risks?

3. What should happen if a vendor fails to meet agreed security requirements?

4. Which approach reduces risk when dealing with critical vendors?

5. True or False: A vendor's ISO 27001 certification guarantees absolute security with no additional risk.

6. What is the purpose of a vendor risk scorecard?

7. Which of the following should be evaluated during vendor security assessments?

8. What does 'vendor lock-in' refer to in risk management?

9. True or False: Third-party risk assessments should only occur at the beginning of a vendor relationship.

10. Which contractual clause protects your organization if a vendor experiences a data breach?

11. What is the primary goal of Third-Party Risk Management in a security program?

12. Which metric helps assess a vendor's financial stability and ability to maintain services?

13. What is the purpose of continuous vendor monitoring?

14. True or False: A vendor's compliance with one security standard eliminates the need for additional risk assessments.

15. What should be included in a vendor risk management policy?

16. Which of the following is a key component of vendor due diligence?

17. What is a 'supply chain attack'?

18. Which framework is commonly used for assessing third-party cybersecurity risks?

19. What does a Service Level Agreement (SLA) typically define in vendor contracts?

20. Which assessment method directly evaluates a vendor's security controls and practices on-site?