CTPRP 2026/2027 QUESTIONS AND SOLUTIONS RATED
A+
✔✔fourth party/subcontractor - ✔✔an entity independent of and directly performing
tasks for the assessee being evaluated
✔✔drivers for third party risk assessments - ✔✔ISO 27002, FFEIC Appendix, OOC
Bulletins, FFEIC CAT Tool, PCI Data Security Standard, NIST Cybersecurity
Framework, HIPAA/HiTech, EU GDPR
✔✔different names for third parties - ✔✔Business Associate, Service Provider,
Processor, Person who provides support for the internal operations of the Web site or
online service, Third-Party Service Provider
✔✔Office of the Comptroller of the Currency (OOC) lifecycle framework for third party
risk - ✔✔Planning, Due Diligence and Third Party Selection, Contract Negotiation,
Ongoing Monitoring, Termination
✔✔False - You must determine the third party's ability to satisfy those requirements. -
✔✔T/F - You can rely on contract requirements to satisfy regulatory requirements for
third parties.
✔✔True - e.g., HIPAA and OFAC - ✔✔T/F - It is possible to be subject to regulations
from different industry sectors
✔✔False - in many instances state requirements may be more stringent than federal -
✔✔T/F - Federal regulations always supersede state regulations
✔✔Audits should ensure compliance with: - ✔✔Corporate, Legal, Regulatory, Industry
requirements
✔✔Risk Assessment and Treatment - ✔✔Describes the vendor's risk assessment
program, and its maturity and operating effectiveness.
✔✔True - ✔✔T/F - A risk assessment program should be approved by management
and communicated to all appropriate constituents
✔✔Different names for data - ✔✔Protected Health Information, Electronic Health
Records, Personally Identifiable Financial Information, Cardholder Data, Personal Data,
Personal Information, Consumer Financial Information
✔✔Personally Identifiable Information (PII) - ✔✔any information about an individual
maintained by an agency, including (1) any information that can be used to distinguish
or trace an individual's identity, such as name, or biometric records and (2) any other
A+
✔✔fourth party/subcontractor - ✔✔an entity independent of and directly performing
tasks for the assessee being evaluated
✔✔drivers for third party risk assessments - ✔✔ISO 27002, FFEIC Appendix, OOC
Bulletins, FFEIC CAT Tool, PCI Data Security Standard, NIST Cybersecurity
Framework, HIPAA/HiTech, EU GDPR
✔✔different names for third parties - ✔✔Business Associate, Service Provider,
Processor, Person who provides support for the internal operations of the Web site or
online service, Third-Party Service Provider
✔✔Office of the Comptroller of the Currency (OOC) lifecycle framework for third party
risk - ✔✔Planning, Due Diligence and Third Party Selection, Contract Negotiation,
Ongoing Monitoring, Termination
✔✔False - You must determine the third party's ability to satisfy those requirements. -
✔✔T/F - You can rely on contract requirements to satisfy regulatory requirements for
third parties.
✔✔True - e.g., HIPAA and OFAC - ✔✔T/F - It is possible to be subject to regulations
from different industry sectors
✔✔False - in many instances state requirements may be more stringent than federal -
✔✔T/F - Federal regulations always supersede state regulations
✔✔Audits should ensure compliance with: - ✔✔Corporate, Legal, Regulatory, Industry
requirements
✔✔Risk Assessment and Treatment - ✔✔Describes the vendor's risk assessment
program, and its maturity and operating effectiveness.
✔✔True - ✔✔T/F - A risk assessment program should be approved by management
and communicated to all appropriate constituents
✔✔Different names for data - ✔✔Protected Health Information, Electronic Health
Records, Personally Identifiable Financial Information, Cardholder Data, Personal Data,
Personal Information, Consumer Financial Information
✔✔Personally Identifiable Information (PII) - ✔✔any information about an individual
maintained by an agency, including (1) any information that can be used to distinguish
or trace an individual's identity, such as name, or biometric records and (2) any other
