Get Shared Assessments CTPRP Exam Practice Questions - Real and Updated

Answer : B

Physical access procedures and activity logs are important components of third-party risk management, as they help to ensure the security and integrity of the physical assets and data of the organization and its third parties. However, requiring physical access logs to be retained indefinitely for audit purposes is not a best practice, as it may pose legal, regulatory, and operational challenges. According to theSupplemental Examination Procedures for Risk Management of Third-Party Relationships, physical access logs should be retained for a reasonable period of time, consistent with the organization's policies and procedures, and in compliance with applicable laws and regulations1.Retaining physical access logs indefinitely may increase the risk of unauthorized access, data breaches, privacy violations, and litigation2. Therefore, the statement B is the correct answer, as it is the only one that does not reflect a best practice for physical access procedures and activity logs.

1: How to Write Third-Party Risk Management (TPRM) Policies and Procedures - SecurityScorecard Blog

2: Five Best Practices to Manage and Control Third-Party Risk - Broadcom Inc.

3: A checklist for third-party risk management platforms - Crowe LLP

4: Supplemental Examination Procedures for Risk Management of Third-Party Relationships

5: Third Party Risk Management: Why It's Important And What Features To Look For - Expert Insights

Answer : B

A mobile device policy is a set of rules and guidelines that define how an organization's employees and contractors can use and secure their mobile devices, such as laptops, smartphones, and tablets, to access the organization's data and network1.A mobile device policy typically covers aspects such as device configuration, authentication, encryption, backup, remote wipe, malware protection, acceptable use, and incident response23.

A mutual NDA is a legal agreement that binds both parties to protect the confidentiality of the information they share with each other. A mutual NDA is usually signed before engaging in a business relationship with a third party, such as a vendor, partner, or customer. A mutual NDA is not directly related to the use and security of mobile devices, and therefore is less likely to be included in an organization's mobile device policy. A mutual NDA may be part of a broader contract or agreement with a third party, but it is not specific to mobile devices.

The other options are more likely to be included in an organization's mobile device policy, as they address the risks and responsibilities associated with mobile devices. For example:

Language on restricting the use of the mobile device to only business purposes can help prevent unauthorized access, data leakage, and malware infection from personal or untrusted applications or websites2.

Language detailing the user's responsibility to not bypass security settings or monitoring applications can help ensure compliance with the organization's security standards and policies, and enable the detection and prevention of potential incidents2.

Language detailing specific actions that an organization may take in the event of an information security incident can help define the roles and responsibilities of the users and the organization, and the procedures for reporting, investigating, and resolving incidents involving mobile devices23.

1: Mobile Device Policy1, Section 1. Introduction

2: Risk Management Guidelines for Mobile Devices2, Section Data Security

3: Guidelines for Managing the Security of Mobile Devices in the Enterprise3, Section 4. Recommendations for Mobile Device Security

[4]: What is a Mutual NDA?, Section What is a Mutual NDA?

[5]: Non-Disclosure Agreement (NDA) Definition, Section Understanding Non-Disclosure Agreements

Answer : C

Notification obligations in incident response are the legal or contractual duties to inform relevant parties about a security breach or incident that affects their data or systems. These obligations may vary depending on the type, scope, and impact of the incident, as well as the jurisdiction, industry, and contractual agreements involved. The factors that are most likely to trigger notification obligations are:

Regulatory requirements:Different laws and regulations may impose different notification obligations on organizations that experience or cause a security incident.For example, the General Data Protection Regulation (GDPR) requires data controllers to notify the supervisory authority within 72 hours of becoming aware of a personal data breach, and to notify the affected data subjects without undue delay if the breach poses a high risk to their rights and freedoms1.Similarly, the Computer-Security Incident Notification Rule requires banks and their service providers to notify their primary federal regulator as soon as possible, but no later than 36 hours, after a computer-security incident that materially disrupts, degrades, or impairs their operations, services, or customers2.

Data classification or sensitivity:The type and sensitivity of the data involved in a security incident may also affect the notification obligations.For example, if the data contains personally identifiable information (PII), health information, financial information, or other confidential or sensitive information, the organization may have to notify the data owners, regulators, law enforcement, or other stakeholders about the incident and the potential risks to their privacy or security3. The data classification or sensitivity may also determine the content and timing of the notification, as well as the appropriate communication channels to use.

Contractual terms:The contractual agreements between an organization and its third-party vendors or service providers may also specify the notification obligations in case of a security incident. For example, the contract may define the roles and responsibilities of each party, the notification procedures and timelines, the information to be shared, the remediation actions to be taken, and the penalties or liabilities for breach of contract. The contractual terms may also reflect the regulatory requirements or industry standards that apply to the organization or the third party.

The factor that is least likely to trigger notification obligations is:

Encryption of data:Encryption of data is a security measure that protects the data from unauthorized access, modification, or disclosure. Encryption of data may reduce the impact or severity of a security incident, as it may prevent or limit the exposure of the data to malicious actors. However, encryption of data does not eliminate the notification obligations, as the organization still has to assess the nature and extent of the incident, and determine whether the encryption was effective or compromised. Moreover, encryption of data may not be sufficient to protect the data from other types of threats, such as deletion, corruption, or ransomware. Therefore, encryption of data is not a factor that influences the notification obligations in incident response.

1:GDPR Article 33: Notification of a personal data breach to the supervisory authority

2:Computer-Security Incident Notification Rule

3:Third-Party Incident Management (TPIM): How to Balance IRPs with Third Parties

: [Improving Third-Party Incident Response]

: [Third-Party Incident Response Playbook]

: [Does Encryption Protect You From a Data Breach?]

Answer : C

One of the key objectives of a TPRM program is to identify and mitigate the risks posed by third parties throughout the relationship life cycle. Therefore, measuring the operational performance of implementing a TPRM program requires tracking the effectiveness and efficiency of the risk management processes and activities. Among the four examples given, calculating the average time to remediate identified corrective actions is the most likely to provide meaningful metrics for this purpose. This metric indicates how quickly and consistently the organization and its third parties can resolve the issues and gaps that are discovered during the risk assessment and monitoring phases. It also reflects the level of collaboration and communication between the parties, as well as the alignment of expectations and standards.A lower average time to remediate implies a higher operational performance of the TPRM program, as it demonstrates a proactive and responsive approach to risk management12.

The other three examples are less likely to provide meaningful metrics for measuring the operational performance of implementing a TPRM program, as they do not directly measure the outcomes or impacts of the risk management activities. Logging the number of exceptions to existing due diligence standards may indicate the level of compliance and consistency of the TPRM program, but it does not show how the exceptions are handled or justified. Measuring the time spent by resources for task and corrective action plan completion may indicate the level of effort and resource allocation of the TPRM program, but it does not show how the tasks and plans contribute to the risk reduction or mitigation. Tracking the number of outstanding findings may indicate the level of exposure and vulnerability of the TPRM program, but it does not show how the findings are prioritized or addressed.Reference:

1: 15 KPIs & Metrics to Measure the Success of Your TPRM Program | UpGuard Blog

2: Third-Party Risk Management Reporting: What You Need to Know - Venminder

Answer : B

This statement does not reflect current practice in addressing fourth party risk or subcontracting risk because it is not sufficient to rely on external audit reports alone. Outsourcers should also perform their own due diligence and monitoring of the subcontractors, as well as ensure that the third party has a robust TPRM program in place. External audit reports may not cover all the relevant aspects of subcontracting risk, such as data security, compliance, performance, and quality. Moreover, external audit reports may not be timely, accurate, or consistent, and may not reflect the current state of the subcontractor's operations. Therefore, outsourcers should adopt a more proactive and comprehensive approach to managing subcontracting risk, rather than relying on external audit reports.Reference:

Shared Assessments Program, page 13: ''Outsourcers should not rely solely on external audit reports to address subcontracting risk. Outsourcers should also inspect the vendor's TPRM program and require evidence of the assessments of subcontractors.''

Five Best Practices to Manage and Control Third-Party Risk, page 3: 'Restricting privileged accounts