Question 1

A

Accepted Answer

Articles of Incorporation A document used to define the company type and often the company ownership structure. Learn about other common due diligence documents in this checklist. Artificial Intelligence (AI) The capability of a computer to solve problems, make decisions, and perceive visual information like humans do. AI is a broad field of study encompassing machine learning, natural language processing, robotics, and more. AI systems can learn from data, recognize patterns, and make decisions with minimal human intervention. Learn more about how industries are using AI in this blog. Audit The review of policies and procedures to assure compliance. An audit can be done by an internal audit team or by an external team (e.g., examiners or auditors). Learn more about the key elements to include in your internal audit program. Audit Opinion Letter Provided by a third-party audit and assurance firm in a financial audit that summarizes the scope of work completed by the audit firm and the findings of the audit. Includes a going concern opinion, an opinion on the internal controls, if reviewed, and discussion about information reviewed by the auditors. Learn what else to look for in a SOC report in this eBook. Availability Part of the CIA Information Security Triad, it ensures that information is available when needed and only to authorized personnel. Learn more about the CIA's Information Security Triad in this podcast.

Question 2

B

Accepted Answer

Background Check Policy Outlined procedures around employee background checks as part of the hiring process. Learn about other considerations you should make prior to signing a vendor contract. Bank Secrecy Act (BSA) Requires banks to assist government agencies in detecting potential illegal activity. Requires financial institutions to have a designated BSA Officer responsible for overseeing and monitoring such activities. Learn more about the Bank Secrecy Act and other regulatory requirements. Bill of Materials (BOM) A comprehensive inventory of the necessary raw materials, components, and instructions needed to create, produce, or fix a product or service. Learn how to request a Bill of Materials from your vendor. Board of Directors A group that is directly involved in the oversight of a third-party risk management program and, in particular, oversees any activity related to high-risk or critical vendors. The board is ultimately responsible for all of the activities of the organization. Learn more about the board's involvement in third-party risk management. Business Associate A person or entity that performs certain functions or activities that involve the use or disclosure of protected health information on behalf of, or provides services to, a covered entity. Business associates must follow the Health Insurance Portability and Accountability Act (HIPAA) rules and regulations as the covered entity. Examples of activities that may require a business associate include data analysis, claims processing or administration, utilization review, and billing. Learn how a business associate can affect your organization in this eBook. Business Associate Risk The risk of harm to individuals or to the covered entity resulting from the business associate’s failure to comply with the HIPAA Privacy Rule and Security Rule requirements. This risk is of particular concern because business associates can have access to large amounts of protected health information. Learn more about the risks tied to business associates in this eBook. Business Continuity Management (BCM) An umbrella term for a comprehensive program that encompasses business continuity (BC), disaster recovery (DR), and pandemic planning. It includes details such as recovery time objectives (RTOs), recovery point objectives (RPOs), and maximum allowable downtime, along with testing to ensure that those metrics are achievable. Learn more about the basics of vendor business continuity. Business Continuity Plan (BCP) A plan to ensure that a business’s significant operations and products/services continue to be delivered in a full, or at a predetermined and accepted, level of availability. The expected level of availability is typically outlined in the service level agreement (SLA) that the organization has with the vendor. Learn what to look for in a vendor's business continuity plan. Business Continuity Risk Occurs when an outside event negatively impacts a third-party vendor’s ability to conduct business and impacts your organization or customers as a result. Business continuity risk can occur when a vendor fails to test business continuity and disaster recovery plans and is unprepared for technology outages and failures. Read more about how a poor business continuity plan can affect your organization. Business Impact Analysis (BIA) A process used to identify and evaluate the potential effects of an interruption to business operations. It helps organizations identify the risks associated with potential disruptions, determine the likelihood of those disruptions occurring, and identify the necessary steps to minimize the potential impact of those disruptions. Learn the purpose of a Business Impact Analysis in this blog.

Question 3

C

Accepted Answer

Camels Rating A supervisory rating system originally developed in the U.S. to classify a credit union’s overall condition. It’s now applied to every bank and credit union in the U.S. and is also implemented outside the U.S. by various banking supervisory regulators. The CAMELS results represent Capital adequacy, Asset quality, Management, Earnings, Liquidity and asset-liability management, and Sensitivity to market risk, which are generally considered highly confidential. Learn more about vendor financials in this blog. Carve-Out Method This method is most common in SOC reporting and means that the subservice organization’s controls are NOT included in the scope of the SOC report. The subservice’s controls have been carved out and aren’t applicable. When a vendor uses this method, it should provide its own due diligence and vendor management documentation. If the method is used for a critical subservice organization, it’s recommended to review your fourth-party’s SOC report during your due diligence review. Note: It’s still always encouraged to review your critical fourth parties whether the carve-out method is used or not. Read this blog to learn when to use the carve out method. Centralized Model With this third-party risk framework, responsibility of vendor management rests with a single group, such as the compliance office or the third-party risk management team. This approach can ensure consistency but will often create some knowledge gaps with vendor managers by excluding them from the TPRM process. Learn more about the goals of a centralized model in this blog. Certificate of Good Standing A certificate issued by the state to let everyone know the company is current on its tax obligation. The Better Business Bureaus (BBBs) will also issue certificates to businesses that operate ethically and don’t have too many complaints. Learn about more due diligence considerations in this checklist. Change Management Policy The documented process for making changes to systems. It should include testing prior to change implementation. A change management policy should increase awareness and understanding of proposed changes across an organization to ensure that all changes are made in a way that minimizes negative impact to services and customers. Learn tips and best practices for collecting vendor due diligence documents. CIA Information Security Triad Stands for confidentiality, integrity, and availability. It’s used to help better understand the vendor’s approach to security and their overall posture on the CIA elements. Learn how your vendor’s approach to CIA impact you and your customers’ data. Cloud Service Provider Organizations providing cloud computing services and solutions to their customers. Cloud service providers typically provide access to cloud-based applications, platforms, storage, and other resources over the internet. These resources are generally hosted and managed by the cloud provider, which allows customers to access their services from anywhere without having to maintain and manage their own hardware and software. Learn key considerations when assessing cloud service providers in this blog. Complaint Escalation Procedure A process in place that defines how complaints will be handled in a variety of scenarios. Learn why monitoring your vendor's complaints is a key part of third-party risk management. Complaint Management The process of establishing policies and procedures around managing and responding to any incoming customer complaints. Learn what is necessary for you and your vendors to effectively manage customer complaints. Complementary Subservice Organization Controls Found in SOC reports, these are the controls the vendor assumes will be implemented by the subservice organization (your fourth-party vendor) and are necessary to achieve the control objectives stated in the vendor’s description of the service organization’s system. Learn more terms commonly found in SOC reports in this eBook. Complementary User Entity Controls SOC reports will usually include CUECs, which are your organization’s responsibility to implement. CUECs will tell your organization what must be done to achieve the vendor’s control objectives. Beware: In these cases, the control objectives stated in the description can be achieved only if these CUECs are suitably designed and operating effectively (by you), along with the controls at the service organization (vendor). Learn more about the importance of Complementary User Entity Controls in this blog. Compliance When your vendor needs to adhere to regulations, industry-specific standards, laws, or your organization’s internal policies and procedures, compliance is a must. You should outline in the vendor contract how compliance will be achieved. Learn more about the basics of vendor compliance in this blog. Compliance Management System The overall structure of an organization’s compliance program which is often cited in examination reports. This structure provides the framework for adherence to all regulatory guidance and consumer protection laws. Learn more about the basics of vendor compliance in this blog. Compliance or Regulatory Risk This risk is present when your third party fails to comply with laws or industry-specific guidelines. Your organization is liable for your third party’s compliance and can be subject to legal action if your third party violates regulations. Examples of compliance risks include violating consumer privacy laws or having insufficient cybersecurity practices. Learn how you can determine a vendor's regulatory risk in this podcast Concentration Risk Present when you use several high-risk or critical products or services from the same third party. If the third party suffers a major business interruption/ failure, you’ll be impacted more severely than if the products and services were provided by different third parties. Concentration risk can also occur when you use too many high-risk or critical vendors within a small geographic area as they’d be simultaneously affected by localized events. Learn the pros and cons of concentration risk in this blog. Confidentiality Part of the CIA Information Security Triad, it’s seeking to prevent unauthorized disclosure of information. Learn more about the CIA's Information Security Triad in this podcast. Confidentiality Agreement In a confidentiality agreement (also known as a nondisclosure agreement or NDA), your organization and your vendor agree to keep certain information private and explain how each party will do that. Learn the importance of a confidentiality agreement in this podcast. Consensus Assessment Initiative Questionnaire (CAIQ) An industry-accepted way to document what security controls exist in infrastructure-as-a-service (IaaS), platform-as-a-service (PaaS), and software as-a-service (SaaS) environments and is available through the Cloud Security Alliance (CSA). If your vendor has a CAIQ completed, you should have it assessed to ensure their posture aligns with your expectations, the cloud control matrix, and industry best practices. Understand the quality of your cloud vendor's control environment with this sample. Consumer Financial Protection Bureau (CFPB) Governing regulatory agency created to enforce federal consumer financial laws and protect consumers. Some of the agency’s major responsibilities include enforcing UDAAP, taking consumer complaints, monitoring emerging consumer risks, etc. Learn more about CFPB guidance in this blog. Contract An agreement between two parties creating a legal obligation for an organization and vendor to perform specific activities. Each of the parties to the contract are legally bound to perform the specified duties outlined within the contract. Gain a high level understanding of vendor contracts with this eBook. Contract Duration This refers to the timeframe for your contract’s duration and includes renewal terms, non-renewal terms, and termination notice periods. Learn more common contract terms and phrases in this blog. Contract Management The administration of written agreements with third parties that provide an organization with products or services. It includes negotiating the terms of contracts and ensuring compliance, change management, and ongoing maintenance of the relationship. It’s the process of coordinating contract creation, execution, and analysis for the purpose of financial benefit, service delivery, and risk management for an organization. Learn key strategies for effective third-party contract management with this blog. Contract Negotiation Involves two or more parties deliberating over the contents of a contract to make a legally binding agreement. Negotiating a contract aims to achieve an agreement that fulfills both parties’ needs, reduces liability, and sets expectations for both parties. It also develops important terms and conditions such as legal and regulatory compliance and defines service level agreements (SLAs). Contract negotiation must always occur before the contract is executed. Learn contract negotiation best practices with this infographic. Contract Provisions Written terms or conditions in a contract. Learn more common contract terms and phrases in this blog. Control Assessment An examination of an organization’s internal controls to determine whether they’re effective in safeguarding assets and information, preventing and detecting errors and fraud, and ensuring the accuracy and completeness of financial reporting. View vendor risk and control assessment samples here. Control Objectives The “meat” of a SOC report is in the Control Objectives, Control Activities, Test Procedures and Results section of the report. Control objectives represent the purpose of the specified control activities at the service organization (vendor) and address the risks that control activities intended to mitigate if implemented properly. Control objectives are accomplished by designing, implementing, maintaining, and auditing an effective set of supporting control activities. Learn more about the importance of controls for vendor relationships. Control Objectives for Information and Related Technology (COBIT) A framework created for information technology (IT) management and IT governance. It’s a supporting tool set that allows managers to bridge the gap between control requirements, technical issues, and business risks. Understand the basics of vendor controls with this blog. Covered Entity According to HIPAA, a covered entity is a healthcare provider, health plan, or healthcare clearinghouse. These can be individuals, organizations, and agencies. For further clarification, use the HHS Covered Entity Decision Tool. Learn more about the HIPAA rule in this blog. Credit Risk Another term for “financial risk,” it exists when your third party has poor or declining financial health. Increasing costs, decreasing revenues, or losing a major customer can force your third party to discontinue a service or product that is crucial to your organization, or the vendor may go out of business entirely. Use this eBook to understand the different types of third-party risk. Critical Vendor A vendor is deemed critical to the organization if any of the three statements below is true: The abrupt loss of the vendor would cause a significant disruption to the operations. The sudden loss of the vendor would impact customers. If the time to restore the service is more than 24 hours, there would be a negative impact on the organization. Use this Infographic to gain a high level understanding of critical vendors. Criticality Refers to the impact that a product or service failure or prolonged, unplanned service interruption would have on an organization or its customer base. Use this blog to determine the criticality of your vendors. Cure Notice A notice used if a vendor fails to meet a contractual agreement and is a document that outlines specific details as to the requirement of curing any service level or product issues. Learn more about measuring vendor performance with this infographic. Cyber Insurance Separate from general liability insurance, cyber insurance covers risks like data breaches, cyberextortion, cybercrime, and cyberwarfare. It should generally cover any costs associated with investigating a data breach, recovering the data, and addressing any legal and regulatory compliance issues. First-party cyber insurance covers your organization, while third-party cyber insurance covers events caused by third parties. Organizations should require third parties accessing their or their customer’s data to have cyber insurance. Learn more about third-party risk vendor insurance in this blog. Cyber or Information Security Risk Includes both cyber and physical security risk. It’s present whenever you have a third party that accesses, transmits, or stores your organization’s sensitive data or that has access to your privileged networks or facilities. The threat of third-party data breaches has grown as hackers have developed more aggressive and sophisticated ways to breach private networks. Any gaps in your third party’s controls must be addressed to protect your organizational or customer data. Learn how to manage cybersecurity risk with this blog. Cybersecurity Incident A security event that has actually or potentially jeopardized the confidentiality, integrity, or availability of an information system. Use this checklist to ensure you're protected against cybersecurity incidents. Cybersecurity Incident &amp; Vulnerability Playbooks A step-by-step guide that outlines the actions to be taken by an organization in the event of a security breach. Use this eBook to understand the consequences of a breach, as well as how you can prepare for one. Cybersecurity Plan A formalized set of policies and procedures designed to protect electronic information from unauthorized access or theft. Use this blog to ensure your vendor has strong third-party risk cybersecurity monitoring plans. Cybersecurity Review An assessment of an organization’s cybersecurity posture, risk management practices, and controls. A cybersecurity review aims to identify vulnerabilities and recommend steps to mitigate risks. Learn about recommend steps to mitigate cybersecurity risks.

Question 4

D

Accepted Answer

Data Breach Intentional or unintentional access to sensitive information through human error or cyberattacks, such as phishing or malware. Learn the different types of vendor data breaches in this blog. Data Classification and Handling Policy Procedures that establish how data will be handled and protected in order to keep it secure. Learn how to mitigate your vendors cybersecurity risk in this blog. Data Flow Diagram A visual showing the information or data flow being transmitted between different network segments across the organization. Learn more this document, and others you should be requesting from high-risk vendors. Data Retention and Destruction Policy Process which identifies the record retention responsibilities of staff, volunteers, board members, and outsiders for maintaining and documenting the storage and destruction of the organization’s documents and records. Learn more best practices for when your vendor is susceptible to data incidents in this blog. Decentralized Model With this third-party risk framework, various lines of business select and work with the vendor directly. The vendor risk or compliance teams may set the rules, but they rely entirely upon the front-line management to execute the rules. This isn’t a recommended approach to third-party risk management as it proves to be inefficient with room for error. Learn about why the hybrid model may be a more efficient option for organizations. Department of Justice (DOJ) Enforcement actions often get referred to Justice when there is a clear violation of law. Learn about the law violations that may get you sent to the Department of Justice. Diagram As part of an organization’s due diligence package, many consider creating diagrams that outline things like data flow, IVR/call routing flows, the network systems and organizational charts of affiliated companies and staff. Learn more about what's include in due diligence in this checklist. Disaster Recovery (DR) A subset of business continuity. The disaster recovery plan outlines the processes and procedures the vendor must perform to ensure resumption of standard operations after a business-impacting event like a severe storm or fire. Learn which documents are required when assessing vendor disaster recovery preparedness. Dispute Resolution In case of future disputes, your vendor contract should outline how and where disputes will be heard and settled. Learn more about effective dispute resolution in this blog. Document Collection Process The process used to formally collect vendor due diligence or other official documentation necessary for third-party risk management. Learn how to improve your document collection process in this infographic. Due Diligence The process of systematically validating the legitimacy and good standing of a vendor. It also formally evaluates the vendor’s risk management practices and controls to ensure they are suitable for mitigating the risks associated with their product or service. Due diligence is a regulatory requirement and one of the most critical elements of third-party risk management. Risk-based due diligence should be completed before contract execution and updated periodically throughout the vendor relationship. It involves collecting and thoroughly analyzing vendor documentation (e.g., financial, SOC, BC/DR plan reviews). Watch this video to learn the 7 steps of risk-based due diligence.

Question 5

E

Accepted Answer

Encryption The process of encoding information by converting the original representation of the information, known as plaintext, into an alternative format to protect sensitive data. Listen to this podcast to learn how to utilize encryption with vulnerable vendors. Enforcement Action A regulatory enforcement action is a legal or administrative action taken by a government agency to enforce a regulation. Listen to this podcast to learn the necessary steps after one of your third parties is named in an enforcement actions. Enhanced Due Diligence (EDD) Provides a closer examination of vendors, particularly in situations where anti-money laundering (AML) violations are a concern. EDD may also set a standard for increased scrutiny on vendors with foreign ownership or those associated with a politically exposed person (PEP). Learn more about the EDD guidance in this blog. Enterprise Risk Management (ERM) A holistic approach to managing risk across an entire organization. It involves identifying, analyzing, and responding to potential and actual risks that might affect the organization’s ability to achieve its objectives. Learn why a third-party risk management platform can compliment your current ERM platform in this blog. Environmental, Social, And Governance (ESG) This is an investment strategy that considers an organization’s performance in environmental, social, and governance issues and financial performance. ESG investing focuses on organizations that are socially responsible and strives to make a positive impact on the environment and society. Learn why you may want to include ESG in your due diligence processes. ESG Risk Risks related to an organization’s impact on the environment, society, and how it’s governed. These risks can affect an organization’s reputation, financial performance, and share price. For example, an organization can face reputational risks if it’s found to be polluting a local river, or it could face financial risks if it doesn’t have the right policies to protect people in its supply chain from exploitation. Learn how to identify Vendor ESG risk in this blog. Evergreen A contract provision within the agreement which automatically extends or renews the term. Learn more contracting terms in this blog. Evidence of Compliance (EOC) Typically, this is an examination conclusion or margin note in the exam report. Learn more about vendor compliance in this blog. Examiner Internal and external individuals who become a key component of an IT exam. Learn about examiner expectations in this blog. Exit Plan Describes the roles and responsibilities of both the organization and a third party at the end of the relationship. As part of an exit plan, stakeholders will be consulted, data will be returned or destroyed, third-party access to networks, systems, and physical facilities will be de-provisioned, records will be retained, and equipment, assets, and intellectual property will be returned. It’s important that exit plans include timing for all required activities and contingency plans in case the third party is unable or unwilling to fulfill their responsibilities. Learn more about successful vendor exit plans in this eBook. Exit Strategy A plan of action for when the vendor relationship terminates, such as a replacement vendor or bringing the function back in-house. Included within the exit strategy is how the organization’s data will be destroyed or returned. Learn the steps to a successful vendor exit strategy in this eBook.

Question 6

F

Accepted Answer

Fairness of Presentation Related to SOC reporting, an auditor will determine if the vendor’s system description is “fairly presented” and whether it accurately represents the system that was designed and implemented as of a specified date (Type I report) or over a specified period of time (Type II report). Learn more about SOC reporting with this blog. FDIC FIL 3-2012 The FDIC set forth additional guidance on managing third-party payment processors and introduced increased monitoring and transactional testing requirements. Learn highlights from the FDIC's guidance in this blog. FDIC FIL 19-2019 The FDIC set forth expectations on financial institutions’ contracts with third-party service providers. Learn more about FDIC expectations in this eBook. FDIC FIL 44-2008 The FDIC set forth formal guidance on expectations for managing third-party risk and third-party payment processors. This guidance was rescinded and replaced by the Interagency Guidance on Third-Party Relationships: Risk Management. Learn more about this guidance's replacement in this eBook. Federal Deposit Insurance Corporation (FDIC) A governing regulatory agency that assists with sustaining stability and confidence in financial systems by doing things like examining financial institutions, insuring deposits, managing receiverships, etc. Learn about the FDIC's many guidance's and regulations in this eBook. Federal Financial Institutions Examination Council (FFIEC) All the major regulators have a seat at the FFIEC table as they mandate uniform principles, standards and report form for governing regulatory agencies. Learn how FFIEC’s Appendix J relates to your vendor risk management program. Federal Reserve (The Fed) A governing regulatory agency established on December 23, 1913 with the enactment of the Federal Reserve Act. Learn about the Fed's place in third-party risk management in this eBook. Federal Reserve Act U.S. legislation created in 1913 that created the current Federal Reserve System. Learn about the Fed's place in third-party risk management in this eBook. FFIEC Appendix J Now a legacy term, this was important and relied upon guidance that was within the FFIEC IT examination handbook and addressed the importance of strengthening the resiliency of outsourced technology services. Learn how FFIEC’s Appendix J relates to your vendor risk management program. Financial Risk This risk exists when your third party has poor or declining financial health. Increasing costs, decreasing revenues, or losing a major customer can force your third party to discontinue a service or product that is crucial to your business, or they may go out of business entirely. Learn the basics of vendor financial risk in this blog. Financial Statement A document reviewed as part of initial and ongoing due diligence to determine the vendor’s financial health (e.g., Form 10-K). Learn the 3 vendor financial statements that should be analyzed. Fintech Financial technology, also known as fintech, is an industry that uses technology to improve financial services and make them more accessible. Financial technology includes a range of services such as mobile payments, money transfers, lending, and investing. Learn third-party risk management best practices for Fintech. Fourth-Party Vendor Your vendor’s vendor. They’re also often called “subcontractors,” “subservice providers,” or “Nth parties.” It’s a company or entity with whom a third-party vendor has a direct written contract to provide an outsourced product or service on behalf of the third-party vendor’s organization. Learn fourth-party vendor best practices in this podcast.

Question 7

G

Accepted Answer

Gap (Bridge) Letter A letter issued by the vendor that covers the “gap” between the last SOC report period end date and the date of the letter. It can be used by the user entity (you) as an interim assurance by management while waiting for the next audit report. Note: The CPA firm who performed the audit is not attesting to anything in the gap letter. Once the auditors have issued their report and left the site, they don’t know if the internal control environment has changed or not. Therefore, a gap letter is merely management’s (management from your vendor) assertion that controls are still in place and operating effectively. Learn the significance of a Gap Letter in this blog. General Data Protection Regulation (GDPR) European regulation, effective May 25, 2018, that protects a customer’s data and privacy. It requires anyone who collects, stores, and processes European customer data to increase their controls. Learn about GDPR's place in vendor management in this blog. Geopolitical Risk The risk of loss caused by political decisions, events, or conditions. This risk can occur when your vendor is located in a country or region vulnerable to political unrest, corruption, or human rights violations. The vendor’s location could also be at risk of lax privacy and information security laws or other situations that could be harmful. Learn about geopolitical risk and how to manage it. Going Concern Means that a business is assumed to meet its financial obligations when they become due. Audit firms will typically provide an opinion on an organization’s going concern. If the audit firm states that the business will remain a going concern without issue, they’ll operate without the threat of liquidation or dissolution for the foreseeable future. This means that the company will be a going concern or not in threat of liquidation or dissolution for at least the next 12 months. Learn more about vendor financial risk in this blog. Governance The process of setting and enforcing policies and procedures to ensure that an organization or group is operating effectively and efficiently. It involves making decisions about the strategies, objectives, and activities of the organization or group and monitoring and ensuring compliance with those decisions. Use this eBook to learn about third-party risk management governance documentation. Gramm-Leach-Bliley Act (GLBA) Requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. GLBA section 501(b) adds standards for financial institutions in administrative, technical, and physical safeguards for the following reasons: To ensure the security and confidentiality of customer records and information To protect against any anticipated threats or hazards to the security or integrity of records To protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any customer Learn more about the Gramm-Leach-Bliley Act in this blog.

Question 8

H

Accepted Answer

Health Industry Cybersecurity Practices (HICP) A set of guidelines and best practices for cybersecurity in the healthcare industry. It was developed by the National Institute of Standards and Technology (NIST) in collaboration with industry stakeholders. Learn how you can implement HICP into your cybersecurity framework. Health Insurance Portability and Accountability Act of 1996 (HIPAA) A federal regulation set forth by the U.S. Department of Health and Human Services which provides data privacy and security protections for protected health information (PHI). The regulation text includes both the Privacy Rule and Security Rule and sets standards for electronic healthcare transactions and types of identifiers. Covered entities include health plans, healthcare clearinghouses, and healthcare providers that transmit health information electronically. Read this blog for a high level overview of the HIPAA rule in healthcare. High-Risk Vendor A vendor who represents a great deal of risk to an organization based on the criteria laid out in risk management policies. Learn how to identify a high-risk vendor in this blog. HITECH Act This 2009 act was established to expand the scope of the HIPAA Security Rule to cover a Covered Entity’s Business Associates. The HITECH Act contains five goals, ranging from the improvement of quality, safety, and efficiency of healthcare to ensuring a patient’s privacy and security. Learn more about healthcare regulations in this blog. HITRUST A nonprofit, standards development organization that specializes in cybersecurity and provides assurance that organizations are meeting those standards. Learn why a HITRUST certification sets certain vendors ahead of the rest in this eBook. Hybrid Model With this third-party risk framework, the vendor management office sets the guidelines and checks the results while working closely with the business units. Learn more about the hybrid model in this blog.

Question 9

I

Accepted Answer

Incident Response Plan/Incident Management Policy A policy that outlines procedures for detection, response, and resolutions of incidents as they can affect the confidentiality, integrity, and availability of information or an information system. Learn what to review in an incident response plan in this podcast. Inclusive Method In relation to SOC reporting, controls supporting normal operations provided by your fourth-party vendor are included within a SOC report. Controls of the fourth party are presented separately from those of the third-party vendor and their written assertions should also be included within the report. Learn the fundamentals of the inclusive method in this blog. Inherent Risk An assessed level of raw or untreated risk. It’s the natural level of risk inherent in a process or activity without doing anything to reduce the likelihood or mitigate the severity of a mishap, or the amount of risk before the application of the risk reduction effects of controls. It’s the most amount of potential risk an engagement could pose. Deepen your knowledge of inherent third-party risk with this blog. Initial Due Diligence Another term for “vendor vetting” and “third-party selection.” It’s implementing pre- contract due diligence to evaluate and select a vendor to outsource a product or service to on behalf of the organization. It should always be completed prior to executing a new contract. &gt;Listen to this podcast to understand the importance of initial due diligence In-Scope Vendors Third-party vendors that are required to comply with third-party risk management policies, processes, and practices. Use this eBook to determine if a third party is in scope. Insurance Documents Required documentation that the vendor must have on file to protect both parties. Their insurance requirements are dependent on the nature of the business (e.g., liability insurance, workers’ compensation insurance). Learn what insurance your vendors should have in this blog. Insurance Standards As part of your vendor’s contract, insurance standards stipulate that your vendor will be held accountable when an incident negatively impacts your organization’s operations or finances. Learn what insurance your vendors should have in this blog. Integrity Part of the CIA Information Security Triad, it’s ensuring that data isn’t modified by unauthorized means. Learn the basics of the CIA triad in this podcast. Interagency Guidance on Third-Party Relationships: Risk Management Final guidance issued by the FDIC, Federal Reserve Board, and OCC in June 2023 which states how supervised banking organizations should manage third-party relationships. Each agency had previously issued their own general third-party risk management guidelines, which were replaced with this final guidance. Learn suggested actions to comply with the Interagency Guidance in this blog. Internal Audit Team who evaluates internal processes and procedures to verify compliance with governing regulations and the organization’s policies and procedures. Learn the essential elements to include in your internal audit program. ISO Certification These certifications, although not mandatory, provide a great indicator of internal process maturity at an organization. If an organization has passed an ISO 27001 audit, you may see the following certifications: ISO 27001 – Creates an Information Security Management System (ISMS) making up the base of information security to build on. ISO 27002 – Contains the controls to put in place once the ISMS is in place. Only ISO 27001 is available for an organization to achieve a certificate as ISO 27002 isn’t a management standard, so a certificate is unavailable. Learn if your vendor should have an ISO certification in this blog. Issue Any unexpected result or scenario requiring further evaluation or actions to mitigate risk. An issue can occur internally within your organization or externally with a vendor. Learn how to categorize vendor issues in this eBook. Issue Management The process of identifying, managing, and tracking issues that arise and remediating them through a collaborative and centralized approach. Learn how to manage vendor issues in this eBook. IVR/Call Routing Flows Standing for Interactive Voice Response, it illustrates the flow an incoming call will take on an organization’s automated voice system. Learn about other common due diligence documents in this checklist.

Question 10

K

Accepted Answer

Key Performance Indicators (KPIs) Measurable values that organizations use to assess their vendor’s progress towards long-term objectives. KPIs provide organizations with an indication of how well vendors are performing and identifies areas for improvement. Learn the importance of KPIs in this blog. Key Risk Indicators (KRIs) Metrics used to measure how likely it is that a particular project or business activity will experience a negative outcome. KRIs help organizations to identify and track risks, and to make decisions about how to manage those risks. Learn more about KRIs and other vendor contract terms in this blog. Know Your Customer (KYC) Establishing customer identification requirements and enhanced standards around account opening and monitoring. Learn why the concept of “knowing your vendor” is equally as important in third party risk management.

Question 11

L

Accepted Answer

Liability Insurance Also called third-party insurance, it’s a fundamental part of your risk management system. It protects your organization from the risks of liabilities from lawsuits and protects the insured in the event they’re sued for claims that fall within the coverage parameters of the insurance policy. Damage caused intentionally and contractual liability aren’t covered under liability insurance policies as it provides coverage for legal fees, which can be quite expensive. This is particularly useful in “nuisance” lawsuits. Learn about the different insurance policies in this blog. Logical Account Management Policy Policy covering access to information systems, data, and applications. Learn more information security best practices in this blog.

Question 12

M

Accepted Answer

Management Assertion In relation to SOC reporting, this is the statement that your vendor’s management produces which describes what they expect their controls and services to accomplish for your organization. This is required to be in a SOC report. The auditor then expresses an opinion on whether management’s assertion is accurate. You should expect that issues or exceptions that have come to management’s attention can result in management’s assertion letter being modified. Look for “except for” or other exclusionary language that was added by management to the letter. Learn more about what should be included in a vendor SOC report. Matters Requiring Attention (MRA) Identified deficiencies that require some form of corrective action from senior management or the board. Learn more about the board's involvement in vendor management in this blog. Maximum Tolerable Downtime (MTD) In relation to business continuity planning, MTD specifies the maximum period of time that the vendor can be down before the disruption in services could cause a significant or material loss. Learn the fundaments of business continuity planning in this podcast. Merger &amp; Acquisition The process of combining two or more companies into one, which often affects vendor operations. Learn how a vendor acquisition can affect your organization in this blog. Metrics Measurable units of data that are used to trace performance. They are typically used to measure things such as customer satisfaction, website traffic, sales, and other key performance indicators. Learn how to develop key metrics for your third-party risk management program. Mid-Term Vendor Contract Review An assessment of a contract or agreement during its active period. It’s usually conducted midway through the contract’s duration to assess the progress of the agreement and to identify areas for improvement. Learn the benefits of a mid-term vendor contract review in this infographic. Mobile Device Management (MDM) Policy or procedure designed to secure and protect mobile devices and make sure employees/vendors are using them correctly in order to mitigate the risk of exposing an organization’s data and information. Learn more about the risk associated with unsecured devices in this blog. Monitoring Activities In relation to SOC reporting, these are the processes used by management of a vendor to monitor the quality of internal control performance during the reporting period. Learn more about SOC reports in this infographic.

Product

Solutions

Risk Categories

Why Venminder

Education

About

Software

Vendor Risk Assessments

Managed Services

Ongoing Monitoring

Venminder Exchange

Use Cases

Industries

Why Venminder

Sample Vendor Risk Assessments

Resources

Webinars

Community

Weekly Newsletter

Venminder Samples

State of Third-Party Risk Management 2023!

Product

Third-Party Risk Management GlossaryTop Terms to Know

Download the glossary PDF

Articles of Incorporation

Artificial Intelligence (AI)

Audit

Audit Opinion Letter

Availability

Background Check Policy

Bank Secrecy Act (BSA)

Bill of Materials (BOM)

Board of Directors

Business Associate

Business Associate Risk

Business Continuity Management (BCM)

Business Continuity Plan (BCP)

Business Continuity Risk

Business Impact Analysis (BIA)

Camels Rating

Carve-Out Method

Centralized Model

Certificate of Good Standing

Change Management Policy

CIA Information Security Triad

Cloud Service Provider

Complaint Escalation Procedure

Complaint Management

Complementary Subservice Organization Controls

Complementary User Entity Controls

Compliance

Compliance Management System

Compliance or Regulatory Risk

Concentration Risk

Confidentiality

Confidentiality Agreement

Consensus Assessment Initiative Questionnaire (CAIQ)

Consumer Financial Protection Bureau (CFPB)

Contract

Contract Duration

Contract Management

Contract Negotiation

Contract Provisions

Control Assessment

Control Objectives

Control Objectives for Information and Related Technology (COBIT)

Covered Entity

Credit Risk

Critical Vendor

Criticality

Cure Notice

Cyber Insurance

Cyber or Information Security Risk

Cybersecurity Incident

Cybersecurity Incident & Vulnerability Playbooks

Cybersecurity Plan

Cybersecurity Review

Data Breach

Data Classification and Handling Policy

Data Flow Diagram

Third-Party Risk Management Glossary
Top Terms to Know