CTPRP Practice Questions

The analysis of a vendor risk assessment is a comprehensive process that must extend beyond the vendor's self-attested questionnaire responses. A fundamental principle of third-party risk management, as outlined by Shared Assessments, is "trust but verify." Relying solely on a questionnaire without validating the responses against objective, corroborating evidence (e.g., SOC reports, penetration test results, policy documents) would provide an incomplete and potentially inaccurate view of the vendor's control environment. A thorough analysis requires the validation of stated controls to ensure they are designed and operating effectively, which is impossible to achieve from questionnaire answers alone.

B. The analysis process helps in identifying control gaps and potential risks.

This is a primary goal of the analysis phase. By comparing vendor responses and evidence against requirements, assessors identify deficiencies and weaknesses.

C. The results of the analysis are used to determine the vendor's residual risk level.

The analysis of control effectiveness is a direct input into calculating residual risk (the risk remaining after controls are applied).

D. The analysis should consider the context of the services being provided by the vendor.

Risk is contextual. The significance of a finding is directly related to the criticality of the service and the sensitivity of the data involved.

1. Shared Assessments. (2023). Certified Third Party Risk Professional (CTPRP) Body of Knowledge.

Reference: Domain 4: The Assessment Process. This domain details the analysis phase, emphasizing that assessors must "validate the information provided by the third party" and that this involves reviewing "supporting documentation and evidence" in conjunction with questionnaire responses. It explicitly contradicts the idea of relying solely on the questionnaire.

2. Shared Assessments. (2023). The Standardized Information Gathering (SIG) Questionnaire User Guide.

Reference: Section on "Using the SIG for Assessments." The guide explains that the SIG is a tool for gathering information, which must then be analyzed and validated. The process involves requesting evidence for key controls, confirming that the analysis phase is not limited to the questionnaire itself.

3. Moeller, R. R. (2011). COSO Enterprise Risk Management: Understanding the New Integrated ERM Framework. John Wiley & Sons.

Reference: Chapter 7: Risk Assessment in Practice. While a general ERM source, it aligns with CTPRP principles by stating that risk assessment involves not just identifying risks but also analyzing them, which includes evaluating the effectiveness of existing controls through testing and evidence review, not just attestation. This principle is directly applicable to third-party risk.

The principle of risk-based due diligence dictates that the level of assessment effort must be proportional to the vendor's risk level. For lower-risk vendors, a streamlined and efficient approach is most appropriate. Sending a lightweight, standardized questionnaire, such as the Shared Assessments Standardized Information Gathering (SIG) Lite, allows an organization to gather essential information about the vendor's control environment. This method fulfills due diligence requirements without imposing the significant resource burden associated with more intensive assessments, which are reserved for vendors posing a higher risk.

A. Conducting an on-site assessment of the vendor's facilities.

This is the most intensive and costly due diligence method, reserved for critical or high-risk vendors where direct verification of controls is necessary.

B. Reviewing the vendor's SOC 2 Type 2 report and audited financial statements.

This is a thorough and time-consuming review, more appropriate for moderate to high-risk vendors, especially those handling sensitive data or critical functions.

D. Forgoing all due diligence activities.

Neglecting due diligence for any vendor, regardless of risk level, is a failure of risk management and may violate regulatory and compliance obligations.

1. Shared Assessments. (2023). Certified Third Party Risk Professional (CTPRP) Body of Knowledge.

Section 3.2.2, "Scoping and Tiering": This section details the methodology of classifying vendors into risk tiers (e.g., high, medium, low). It explicitly states that the level and intensity of due diligence activities should directly correspond to the assigned risk tier. Low-tier vendors undergo a less rigorous assessment process.

2. Shared Assessments. (2023). Standardized Information Gathering (SIG) Questionnaire.

Document Purpose, "SIG Lite Questionnaire": The official documentation for the SIG describes the SIG Lite as being "designed for organizations that need a basic level of due diligence" and is "appropriate for third parties that are lower risk." This directly supports using a streamlined questionnaire for low-risk vendors.

3. The Santa Fe Group, Shared Assessments. (2020). Governing and Managing Third Party Risk.

Chapter 4, "The Third Party Risk Management Lifecycle - Due Diligence": This chapter emphasizes that a "one-size-fits-all" approach to due diligence is inefficient and ineffective. It advocates for a tiered approach where the depth of the assessment is driven by the inherent risk of the third-party relationship. For low-risk relationships, it suggests leveraging less resource-intensive tools like simplified questionnaires.

An analysis of the question is provided below.

Evaluation of the Question

The question asks to identify the requirement that is not aligned with a "Zero Trust" approach to access management for third parties. The core principle of Zero Trust is to abandon the idea of a trusted internal network and an untrusted external network. Instead, it mandates that every access request must be strictly verified, regardless of its origin. This involves verifying the user and device, ensuring least-privilege access, and assuming the environment is already compromised. The correct answer will be the option that relies on an implicit trust model, such as trust based on network location.

Correct Answer: A

A. Granting access based on the third party's location within a "trusted" network segment.

Explanation

A Zero Trust architecture is a security model based on the principle of "never trust, always verify." It assumes that no user or device is inherently trustworthy, regardless of its physical or network location. Granting access based on a third party's presence within a so-called "trusted" network segment directly contradicts this core tenet. Zero Trust requires that all access requests be authenticated, authorized, and encrypted before access is granted, and that access is limited to the minimum necessary resources (least privilege). Location-based trust is a feature of traditional, perimeter-based security models, which Zero Trust is designed to replace.

Why Incorrect Options are Wrong

B. Enforcing multi-factor authentication (MFA) for every access request from the third party.

This is a core component of Zero Trust, as it strengthens identity verification for every access attempt, aligning with the "always verify" principle.

C. Implementing the principle of least privilege, restricting access to only the specific resources required for the contracted task.

This is a foundational pillar of Zero Trust. It minimizes the potential impact of a compromised account by strictly limiting a user's access to only what is essential.

D. Continuously monitoring and validating the security posture of third-party devices before granting access.

This reflects the dynamic and continuous verification aspect of Zero Trust, where trust is not a one-time event but is constantly assessed based on real-time signals.

References

1. National Institute of Standards and Technology (NIST). (2020). Special Publication 800-207: Zero Trust Architecture.

Section 2.1, Tenets of Zero Trust: "All communication is secured regardless of network location... Access to individual enterprise resources is granted on a per-session basis... Access to resources is determined by dynamic policy—including the observable state of client identity, application/service, and the requesting asset—and may include other behavioral and environmental attributes." This directly refutes the idea of a trusted network segment (Option A) and supports continuous validation (Option D).

2. The Shared Assessments Program. (2023). CTPRP Body of Knowledge.

Domain 4: Third Party Risk Management Controls, Section on Access Control: The curriculum emphasizes modern access control frameworks that move beyond perimeter security. It describes Zero Trust as a strategic approach where "no user or system is trusted by default." It explicitly contrasts this with legacy models that grant broad access once a user is on the "trusted" network, making Option A inconsistent with CTPRP teachings.

3. Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). Zero Trust Architecture. National Cybersecurity Center of Excellence (NCCoE), NIST.

Page 11, Section 3.1.1, Implicit Trust Zone: "In a ZTA, a trust zone is a discrete network segment that is assigned to a single logical owner... However, this does not mean that assets in the trust zone are implicitly trusted. All assets and subjects in the trust zone must have all access requests validated before access is granted." This publication clarifies that even within defined network segments, implicit trust is eliminated, directly invalidating the approach in Option A.

The multiple-choice options for this question were not provided. Determining the MOST important next step after receiving a vendor questionnaire depends on the specific procedural choices presented. Without the list of possible next steps, the most critical action according to CTPRP best practices cannot be identified.

Not applicable as no options were provided.

Not applicable as the question is incomplete.

The attribute most consistently required in a well-governed Software Development Life-Cycle is the integration of security controls and testing at defined gates (requirements, design, coding, test, release). NIST SP 800-64 rev.2 and ISO/IEC 27034 both state that security requirements and verification activities must be embedded in every SDLC phase to ensure vulnerabilities are discovered and remediated before deployment; other operational disciplines (e.g., physical security or financial viability) are managed elsewhere, not within the SDLC workflow itself.

A – Business-continuity tests are performed post-deployment and are not an intrinsic SDLC activity.

B – Vendor financial viability is part of third-party due-diligence, not a software build process element.

D – Physical access reviews relate to facility security, not to the code-centric SDLC phases.

1. NIST SP 800-64 rev.2, §3.2–3.6 (Security in each SDLC phase).

2. ISO/IEC 27034-1:2011, §7.3 (“integrate application security controls into the SDLC”).

3. Shared Assessments Standardized Information Gathering (SIG) 2023, Domain 4, Control 4.3.1 (secure SDLC checkpoints).

For system-to-system access (e.g., APIs), where systems are tightly integrated, an uncoordinated change can cause immediate failure. The most effective control to prevent business disruption is a contractual requirement for the service provider to give advance notice of changes and provide a test environment. This allows the outsourcer to proactively test the change's impact on its own systems before production deployment. This preventative approach identifies and resolves integration issues beforehand, directly reducing the risk of business disruption.

A. Requiring all changes to be approved by the outsourcer's CEO is impractical, inefficient, and creates bottlenecks for routine operational changes.

C. Ensuring the service provider has a comprehensive rollback plan is a reactive control; it helps recover from a failure but does not prevent the initial disruption.

D. Limiting the frequency of changes to once per year is overly restrictive, stifles innovation, and does not guarantee that the single annual change will be non-disruptive.

1. Shared Assessments, Certified Third Party Risk Professional (CTPRP) Body of Knowledge, Domain 4: Ongoing Monitoring & Review. This domain emphasizes the need for continuous oversight, including managing changes made by third parties that could impact the outsourcer's operations.

2. ITIL Foundation, ITIL 4 Edition. AXELOS, 2019. The "Change Enablement" practice (formerly Change Management) emphasizes assessing risks, scheduling, and testing changes to prevent negative impacts on services, aligning with the principle of providing notice and a test environment.

A network access policy defines the rules and requirements for connecting to and using an organization's network resources. It focuses on logical access controls. This includes user authentication methods, rules for remote connections (e.g., VPN), and acceptable use guidelines. Procedures for data backup and recovery, while a critical IT security function, are typically detailed in a separate Business Continuity and Disaster Recovery (BCDR) policy. The BCDR policy addresses data resilience and service restoration, which is distinct from the scope of controlling active access to the network.

(Based on inferred standard options)

A. Rules for remote access connections: This is a core component of a network access policy, defining how users connect securely from outside the corporate network.

B. User authentication methods: This is fundamental to network access, specifying requirements like passwords, MFA, and biometrics to verify user identity.

D. Acceptable use guidelines: This section outlines what users are permitted and prohibited from doing while connected to the network, forming a key part of the policy.

1. Shared Assessments. (2023). Standardized Information Gathering (SIG) Questionnaire. Domain: Access Control. The SIG questionnaire includes specific questions on policies governing remote access, authentication, and authorization, distinguishing them from BCDR controls found in the "Business Resilience" domain.

2. Tipton, H. F., & Krause, M. (Eds.). (2007). Information Security Management Handbook, Sixth Edition. CRC Press. Chapter 10, "Access Control," details the components of access control policies, focusing on identification, authentication, authorization, and accountability, separate from disaster recovery planning.

After completing a third-party assessment, it is crucial to hold an internal review meeting before engaging the vendor. The primary stakeholder in this meeting is the internal business relationship owner. This individual or team owns the relationship with the vendor, understands the business context and criticality of the service, and is ultimately responsible for the risk associated with the engagement. Their approval and alignment on the severity of findings and proposed remediation plans are essential to ensure that the subsequent conversation with the vendor is unified, consistent, and focused on the organization's specific risk appetite and business needs.

A) The third party's Chief Information Security Officer: Engaging the vendor's CISO is a step that occurs after the internal team has aligned on the findings and required actions.

C) The external auditors: External auditors may review the TPRM process, but they are not involved in the operational step of approving specific vendor remediation plans.

D) The third party's account manager: This is a vendor representative. All discussions with the vendor should happen only after the internal strategy and requirements are finalized.

1. The Shared Assessments Program. (2019). Third Party Risk Management Blueprint. This guide outlines the TPRM lifecycle, emphasizing the role of the business/line of business (LOB) owner in risk identification, assessment, and ongoing monitoring phases. The "Remediation & Ongoing Monitoring" phase requires LOB involvement to validate that risks are addressed according to business requirements.

2. NIST. (2021). Special Publication 800-161 Rev. 1: Supply Chain Risk Management Practices for Federal Information Systems and Organizations. Section 2.3.2 discusses establishing roles and responsibilities, highlighting that the "mission or business owner" is a key participant in managing supply chain risks.

Notification obligations for a data incident are determined by legal, regulatory, and contractual mandates. These frameworks establish specific triggers based on the nature and impact of the incident. Critical factors include the type of data compromised (e.g., PII, PHI), the jurisdiction of the affected data subjects (which determines applicable laws like GDPR or CCPA), and the number of individuals affected (which can trigger different levels of notification). The time of day an incident occurs is a factual detail relevant to the investigation and timeline reconstruction, but it is not a substantive factor that legally or contractually creates the obligation to notify.

A. The type of data compromised is a primary trigger, as laws are highly specific about protecting PII, PHI, and other sensitive information.

B. The jurisdiction where data subjects reside determines which legal frameworks (e.g., GDPR, CCPA) and notification rules apply.

D. The number of individuals affected is a critical factor, often triggering mandatory notifications to regulatory bodies or the media above certain thresholds.

1. Shared Assessments CTPRP Body of Knowledge: The CTPRP curriculum's domain on "Incident Management, Business Continuity, and Disaster Recovery" emphasizes that response and notification procedures are governed by legal, regulatory, and contractual requirements. These requirements are based on data type, jurisdiction, and incident severity, not the time of occurrence. (Reference: CTPRP Body of Knowledge, Domain 8: Incident Management).

2. University Courseware: Berkeley Law's course materials on Information Privacy Law detail the triggers for data breach notification statutes. Analysis consistently focuses on three core elements: (1) a security breach, (2) the type of personal information involved, and (3) the likelihood of harm. The time of day is not considered a legal trigger. (Reference: Berkeley Law, Samuelson Law, Technology & Public Policy Clinic, Data Breach Notification Laws Course Materials).

3. Academic Publications: In "An Analysis of Data Breach Notification Statutes," the authors review the legislative landscape, noting that notification triggers are universally tied to the unauthorized acquisition of specific data types (e.g., Social Security numbers) and the residency of the affected individuals. Thresholds based on the number of affected persons are also common. (Reference: Thomas, R. S., & Litan, R. E. (2009). An Analysis of Data Breach Notification Statutes. Searle Civil Justice Institute. Section II: "Common Elements of State Data Breach Notification Statutes").

An IT Asset Management (ITAM) program focuses on the systematic management of technology assets owned by the organization throughout their lifecycle. Core components include maintaining a central asset inventory, managing the asset lifecycle (procurement to disposal), and ensuring software license compliance. While an organization must manage the risks associated with personal devices accessing corporate data (BYOD), the policies governing these devices are typically part of a separate security or acceptable use policy framework, not a foundational component of the ITAM program itself. ITAM's scope is centered on corporate-owned property.

A. A centralized asset repository for tracking hardware and software: This is incorrect because a definitive inventory is the cornerstone of any ITAM program, providing visibility and control over all assets.

C. Processes for managing the entire asset lifecycle: This is incorrect because managing assets from acquisition through retirement is the fundamental purpose and definition of an ITAM program.

D. Software license management and compliance tracking: This is incorrect because Software Asset Management (SAM) is a critical and integrated sub-component of a comprehensive ITAM program.

1. Shared Assessments. (2023). Standardized Information Gathering (SIG) Questionnaire. The "Asset Management" (AM) domain in the SIG (e.g., AM-1, AM-2) explicitly requires maintaining an inventory of information assets and defining procedures for their handling throughout the lifecycle, including secure disposal. It does not, however, list the creation of BYOD policy as a core program component.

2. ISO/IEC 19770-1:2017. (2017). Information technology — IT asset management — Part 1: IT asset management systems — Requirements. This international standard defines the scope of an ITAM system as managing organizational assets. Section 4.2, "Understanding the needs and expectations of interested parties," and Section 6.1, "Actions to address risks and opportunities," cover related areas, but the core processes outlined (e.g., Section 8, "Operation") focus on the lifecycle of assets under the organization's direct control.

3. National Institute of Standards and Technology (NIST). (2020). Special Publication 800-53, Revision 5: Security and Privacy Controls for Information Systems and Organizations. The Configuration Management (CM) control family, specifically CM-8 "System Component Inventory," mandates maintaining a current inventory of all system components, which directly supports options A, C, and D as core functions. BYOD is addressed separately under controls like AC-19 "Access Control for Mobile Devices."