CSC Third-Party Vendor Compliance 2 — Questions and Answers
Question 1: Which document formally defines the security obligations a vendor must meet before handling your organization's data?
- Business Associate Agreement
- Master Service Agreement
- Security Addendum
- Data Processing Agreement (Correct answer)
Correct answer: Data Processing Agreement
A Data Processing Agreement (DPA) specifically governs how a vendor processes personal or sensitive data and the security controls required.
Question 2: A vendor's SOC 2 Type II report covers a 12-month period ending six months ago. What is the primary concern?
- The report is too old to be relevant
- The audit scope may not match your requirements
- Controls may have changed since the report period ended (Correct answer)
- SOC 2 Type II reports expire after 3 months
Correct answer: Controls may have changed since the report period ended
A gap between the report period and today means new vulnerabilities or control failures may exist that are not reflected in the report.
Question 3: What is 'fourth-party risk' in the context of vendor compliance?
- Risk from a vendor's subcontractors or suppliers (Correct answer)
- Risk introduced by four simultaneous vendor audits
- Risk from the fourth tier of internal management
- Risk from vendors operating in four or more countries
Correct answer: Risk from a vendor's subcontractors or suppliers
Fourth-party risk refers to the risk that your vendor's own vendors (subcontractors) introduce into your supply chain.
Question 4: When should a Vendor Risk Assessment be updated beyond the standard annual cycle?
- Only when a new contract is signed
- When the vendor announces a material change such as an acquisition or data breach (Correct answer)
- Quarterly regardless of changes
- When the vendor's pricing changes
Correct answer: When the vendor announces a material change such as an acquisition or data breach
Material changes such as acquisitions, breaches, or major service changes can alter a vendor's risk profile and require immediate reassessment.
Question 5: A vendor refuses to complete your security questionnaire, citing trade secrets. What is the best response?
- Accept the vendor without assessment
- Request an independent third-party attestation or audit report instead (Correct answer)
- Reduce the questionnaire to only three questions
- Sign a mutual NDA and require full completion
Correct answer: Request an independent third-party attestation or audit report instead
Third-party attestations such as SOC 2 or ISO 27001 certificates can satisfy due diligence requirements without exposing the vendor's proprietary details.
Question 6: Which regulatory framework specifically requires covered entities to have Business Associate Agreements with vendors that handle protected health information?
- PCI DSS
- HIPAA (Correct answer)
- SOX
- NIST CSF
Correct answer: HIPAA
HIPAA mandates Business Associate Agreements (BAAs) with any vendor that creates, receives, maintains, or transmits protected health information on behalf of a covered entity.
Question 7: What is the purpose of a vendor tiering or classification system in a third-party risk program?
- To rank vendors by price
- To allocate due diligence effort proportionally based on risk level (Correct answer)
- To determine vendor payment priority
- To standardize contract lengths across vendors
Correct answer: To allocate due diligence effort proportionally based on risk level
Vendor tiering ensures that critical or high-risk vendors receive intensive scrutiny while low-risk vendors receive lighter-touch assessments, optimizing program resources.
CSC Third-Party Vendor Compliance 2
Which document formally defines the security obligations a vendor must meet before handling your organization's data?