CTPRP Flash Cards
Third Party - ANS-entities or persons that work on behalf of the organization but are not
its employees, including consultants, contingent workers, clients, business partners,
service providers, subcontractors, vendors, suppliers, affiliates and any other person or
entity that accesses customer, company confidential / proprietary data and or systems
that interact with the data
Increased need for third party oversight - ANS-- relationship between organizations and
their 3rd parties has become more complicated
-risk associated with working with 3rd parties has become more complex as 3rd parties
have become popular targets for cyber attacks
-regulatory environment has become more complex
-vendors increasingly targeted by criminals
Establish a formal governance model - ANS--define clear roles and responsibilities for
3rd party risk management
-create a risk management framework to focus your approach
"right Size" your structure based on risk
"right Size" your structure based on risk - ANS--identify emerging risks that affect your
program
-determine frequency of reviews
-identify the level of formality/ documentation you need
-identify the key process in scope for your governance model
Defined Program Goals - ANS-Establish clearly defined strategies, goals and objectives
for your vendor risk management program
Establishing Program Alignment - Three Lines of Defence - ANS-Determine how your
TPRM Program will align with the 3 lines of defense for risk management. While TPRM
usually resides in the 2nd LoD, establishing how it interacts with the other LoDs us
critical
First Line of Defense - ANS-consists of the lines of business who utilize the outsourced
services. OWNS THE RISK
Third Party - ANS-entities or persons that work on behalf of the organization but are not
its employees, including consultants, contingent workers, clients, business partners,
service providers, subcontractors, vendors, suppliers, affiliates and any other person or
entity that accesses customer, company confidential / proprietary data and or systems
that interact with the data
Increased need for third party oversight - ANS-- relationship between organizations and
their 3rd parties has become more complicated
-risk associated with working with 3rd parties has become more complex as 3rd parties
have become popular targets for cyber attacks
-regulatory environment has become more complex
-vendors increasingly targeted by criminals
Establish a formal governance model - ANS--define clear roles and responsibilities for
3rd party risk management
-create a risk management framework to focus your approach
"right Size" your structure based on risk
"right Size" your structure based on risk - ANS--identify emerging risks that affect your
program
-determine frequency of reviews
-identify the level of formality/ documentation you need
-identify the key process in scope for your governance model
Defined Program Goals - ANS-Establish clearly defined strategies, goals and objectives
for your vendor risk management program
Establishing Program Alignment - Three Lines of Defence - ANS-Determine how your
TPRM Program will align with the 3 lines of defense for risk management. While TPRM
usually resides in the 2nd LoD, establishing how it interacts with the other LoDs us
critical
First Line of Defense - ANS-consists of the lines of business who utilize the outsourced
services. OWNS THE RISK
