Ctprp
Vendor Risk Program Framework - ANS-Definition, Execution Management
Governance Elements - ANS-Establish governance Model
Define program goals
Centralized or Decentralized
Policies should - ANS-Be defined at enterprise
Include all corporate funtions
Compliance - ANS-Identify, assess, demonstrate
Infosec policy must - ANS-Br reviewed annually
Assessed for adaquecy
Communicsted to all personell
Contain incident mgmt and exception process
Hr security - ANS-Training
Onboarding
Emploee qualification and drug screening
Agreement that 3rd party does this
Ethics and code of conduct
Termination policies
Sdlc - ANS-Inventory
Risk prioritization
Controls and testing
Defect mgmt
Evergreen procrss
Phases of 3rd party - ANS-Align and plan
Due dilligence 3rd party selection
Overdsght and accountability
Vendor Risk Program Framework - ANS-Definition, Execution Management
Governance Elements - ANS-Establish governance Model
Define program goals
Centralized or Decentralized
Policies should - ANS-Be defined at enterprise
Include all corporate funtions
Compliance - ANS-Identify, assess, demonstrate
Infosec policy must - ANS-Br reviewed annually
Assessed for adaquecy
Communicsted to all personell
Contain incident mgmt and exception process
Hr security - ANS-Training
Onboarding
Emploee qualification and drug screening
Agreement that 3rd party does this
Ethics and code of conduct
Termination policies
Sdlc - ANS-Inventory
Risk prioritization
Controls and testing
Defect mgmt
Evergreen procrss
Phases of 3rd party - ANS-Align and plan
Due dilligence 3rd party selection
Overdsght and accountability
