Free Shared Assessments CTPRP Practice Exam with Questions & Answers | Set: 4

Virtual assessments are a method of conducting third party risk assessments remotely, using various tools and techniques to collect and verify information about the third party’s controls, processes, and performance. Virtual assessments can be used to evaluate various risk domains, such as information security, privacy, resiliency, and compliance, depending on the scope and objectives of the assessment. Virtual assessments can also be used to complement or supplement onsite assessments, especially when travel or access restrictions are in place.

One of the key components of virtual assessments is the use of interviews with subject matter experts (SMEs) from the third party, who can provide insights and clarifications on the third party’s policies, procedures, practices, and evidence. Interviews can also be used to validate or confirm the understanding of key controls, and not just to review questionnaire responses. However, interviews are not the only way to perform controls evaluation and testing in virtual assessments. Other methods include:

• Requesting and reviewing documentation and artifacts from the third party, such as policies, standards, certifications, attestations, test results, audit reports, or incident logs, that demonstrate the implementation and effectiveness of the controls.
• Performing live or recorded demonstrations of the controls, such as showing how the third party monitors, detects, and responds to security incidents, or how the third party encrypts, backs up, and restores data.
• Using remote access tools or platforms, such as screen sharing, video conferencing, or web portals, to observe and verify the controls in action, such as checking the configuration settings, access rights, or patch levels of the third party’s systems or applications.
• Using independent or external sources of information, such as ratings, benchmarks, or feedback, to validate and compare the third party’s performance, compliance, or reputation.

Therefore, the statement that virtual assessments include using interviews with SMEs since controls evaluation and testing cannot be performed virtually is false, as there are other ways to perform controls evaluation and testing in virtual assessments, besides interviews.

References:

• 1: Shared Assessments, a leading provider of third party risk management solutions, offers a comprehensive guide for Certified Third Party Risk Professional (CTPRP) candidates, which covers the core concepts and best practices of third party risk management, including virtual assessments.
• 2: Schneider Downs, a professional services firm, provides a blog post on the best practices for conducting third party risk management virtual assessments, which includes the methods and steps for performing controls evaluation and testing remotely.
• 3: Shared Assessments, a leading provider of third party risk management solutions, offers a blog post on the value and challenges of virtual assessments, which includes the benefits and drawbacks of using interviews and other techniques for controls evaluation and testing.

When calculating residual risk, the best practice for an assessor is to adjust the vendor risk rating based on the changes to the risk level after analyzing the findings and considering the effectiveness of mitigating controls. Residual risk refers to the level of risk that remains after controls are applied to mitigate the initial (inherent) risk. By evaluating the findings from a third-party assessment and factoring in the mitigating controls implemented by the vendor, the assessor can more accurately determine the remaining risk level. This adjusted risk rating provides a more realistic view of the vendor's risk profile, aiding in informed decision-making regarding risk management and vendor oversight.

References:

• The concept of residual risk calculation is discussed in risk management frameworks such as ISO 31000 (Risk Management - Guidelines), which guides the assessment and treatment of risks.
• The "Third-Party Risk Management Guide" by ISACA outlines the process of assessing and managing risks associated with third parties, including the calculation of residual risk.

A well-defined third party risk management program does not require conducting onsite or virtual assessments for all third parties, as this would be impractical, costly, and inefficient. Instead, a TPRM program should adopt a risk-based approach to determine the frequency, scope, and depth of assessments based on the inherent and residual risks posed by each third party. This means that some third parties may require more frequent and comprehensive assessments than others, depending on factors such as the nature, scope, and criticality of their services, the sensitivity and volume of data they access or process, the regulatory and contractual obligations they must comply with, and the results of previous assessments and monitoring activities. A risk-based approach to assessments allows an organization to allocate its resources and efforts more effectively and efficiently, while also ensuring that the most significant risks are adequately addressed and mitigated. References:

• Shared Assessments, CTPRP Job Guide, page 9: “The frequency, scope, and depth of assessments should be determined by the inherent and residual risks posed by each third party.”
• OneTrust, [What is Third-Party Risk Management?]: “A risk-based approach to third-party risk management means that you prioritize your efforts and resources based on the level of risk each vendor poses to your organization.”
• [Deloitte], [Third Party Risk Management: Managing Risk]: “A risk-based approach to third-party risk management helps organizations prioritize their efforts and resources based on the level of risk each third party poses to the organization.”

In the context of Third-Party Risk Management (TPRM), problems or issues do not inherently lead to systemic failures but are indicative of underlying faults within processes or systems that could potentially result in incidents. Problem or issue management is a critical component of TPRM, focusing on identifying, classifying, and managing the root causes of incidents to prevent their recurrence and mitigate their impact. Effective problem management involves not just managing workarounds or known errors, but also implementing permanent fixes to eliminate the root causes of problems. By addressing the underlying issues, organizations can enhance their operational resilience and reduce the likelihood and impact of future incidents. This approach aligns with best practices in TPRM, emphasizing proactive risk identification, assessment, and mitigation to safeguard against potential disruptions in the supply chain and third-party ecosystems.

References:

• Best practices in TPRM suggest a structured approach to problem and issue management, including identification, assessment, prioritization, and resolution of root causes, as outlined in frameworks such as ISO 31000 (Risk Management) and NIST SP 800-53 (Security and Privacy Controls for Federal Information Systems and Organizations).
• Learning resources such as the "Third Party Risk Management Program Playbook" from Shared Assessments and the "Third-Party Risk Management Guide" from ISACA provide comprehensive guidelines on implementing effective problem and issue management processes within a TPRM program.

Application whitelisting is a security technique that allows only authorized applications to run on a device or network, preventing malware or unauthorized software from executing. While this can be a useful security measure, it is not directly related to remote access risk evaluation, which focuses on the security of the connection and the access rights of the remote users. The other options are more relevant to remote access risk evaluation, as they help to monitor, control, and audit the remote access activities and prevent unauthorized or malicious access. References:

• 1: Secure Remote Access: Risks, Auditing, and Best Practices
• 2: 5 Common Vulnerabilities Associated With Remote Access

Application version control standards for software release updates are not part of the IT change management approval process, but rather a technical aspect of the software development lifecycle. The IT change management approval process is a formal and structured way of evaluating, authorizing and scheduling changes to IT systems and infrastructure, based on predefined criteria and roles. The IT change management approval process typically includes the following components123:

• A change request form that captures the details, rationale, impact, risk and benefits of the proposed change
• A change approval board (CAB) or other authorized approvers who review and approve or reject the change request based on the business case, feasibility and alignment with the organization’s objectives and policies
• A documented audit trail for all changes, especially emergency changes, that records the date, time, reason, approver and outcome of each change
• A defined roles and responsibilities matrix that clarifies the expectations and accountabilities of each stakeholder involved in the change management process, such as the change manager, change owner, change coordinator, change implementer and change requester
• A set of guidelines that restrict the approval of changes to only authorized personnel who have the appropriate knowledge, skills and authority to make decisions about the changes References:
• 1: Change Approval Process in ITIL Change Management
• 2: Guide to the IT Change Requests Approval Process
• 3: Overview of the change management approval process

Shadow IT is the use and management of any IT technologies, solutions, services, projects, and infrastructure without formal approval and support of internal IT departments. Shadow IT can pose significant security risks to the organization, such as data breaches, compliance violations, malware infections, or network disruptions. Therefore, assessing and mitigating the risk of shadow IT is an essential part of organizational security.

One of the most important factors when assessing the risk of shadow IT is whether the organization maintains adequate policies and procedures that communicate required controls for security functions. Policies and procedures are the documents that define the organization’s security objectives, standards, roles, responsibilities, and processes. They provide guidance and direction for the organization’s security activities, such as risk assessment, vendor management, incident response, data protection, access control, etc. They also establish the expectations and requirements for the organization’s employees, vendors, and other stakeholders regarding the use and management of IT resources.

By maintaining adequate policies and procedures that communicate required controls for security functions, the organization can:

• Educate and inform its employees about the security risks and implications of shadow IT, and the benefits and advantages of using authorized and supported IT resources.
• Establish and enforce clear and consistent rules and boundaries for the use and management of IT resources, and the consequences and penalties for violating them.
• Monitor and audit the compliance and performance of its employees, vendors, and other stakeholders regarding the use and management of IT resources, and identify and address any deviations or issues.
• Review and update its policies and procedures regularly, and communicate any changes or updates to its employees, vendors, and other stakeholders.

By doing so, the organization can reduce the likelihood and impact of shadow IT, and increase the visibility and accountability of its IT environment. The organization can also foster a culture of security awareness and responsibility among its employees, vendors, and other stakeholders, and encourage them to report and resolve any shadow IT incidents or problems.

The other factors, such as the organization’s security training and certification, staffing levels, and resources and investment, are also relevant for assessing the risk of shadow IT, but they are not as important as the organization’s policies and procedures. Security training and certification can help the organization’s security personnel to acquire and maintain the necessary skills and knowledge to deal with shadow IT, but they do not address the root causes or motivations of shadow IT. Staffing levels can affect the organization’s ability to detect and respond to shadow IT, but they do not prevent or deter shadow IT from occurring. Resources and investment can enable the organization to provide adequate and appropriate IT resources to its employees, vendors, and other stakeholders, but they do not guarantee the satisfaction or compliance of those parties. References:

• : Shadow IT Explained: Risks & Opportunities - BMC Software
• : What is Shadow IT? | IBM
• : Shadow IT: What Are the Risks and How Can You Mitigate Them? - Ekran System
• : Policies and Procedures - Shared Assessments