Shared Assessments CTPRP Exam Questions

A risk register is a tool that records and tracks the identified risks, their probability, impact, status, and mitigation actions throughout the life cycle of a third-party relationship1.A risk register typically includes the following components2:

A unique identifier for each risk

A description of the risk and its source

A rating or grading of the risk according to a risk assessment table or hierarchy

An assessment of the impact and likelihood the risk will occur and the possible seriousness

An outline of proposed mitigation actions and assignment of risk owner

A status update on the risk and the progress of the mitigation actions

A target date for resolving the risk or closing the action A vendor inventory is a list of all the third parties that a banking organization engages with, along with relevant information such as the type, scope, and nature of the services provided, the contract terms and conditions, the performance indicators, and the risk ratings3. A vendor inventory is not a component of a risk register, but rather a separate document that supports the planning and due diligence phases of the third-party relationship life cycle. A vendor inventory may be prioritized by contract value, but also by other criteria such as the criticality of the service, the risk level of the vendor, and the strategic importance of the relationship.Reference:

1: Third-Party Risk Management (TPRM): Final Interagency Guidance, KPMG, June 2023

2: What Is Third-Party Risk Management (TPRM)? 2024 Guide, UpGuard, January 2024

3: Third-Party Risk Management Guidance, OCC Bulletin 2023-29, October 2023

[4]: Certified Third Party Risk Professional (CTPRP) Study Guide, Shared Assessments, 2023

[5]: Best Practices Guidance for Third-Party Risk, GARP, February 2023

Fourth-Nth party risk refers to the potential threats and vulnerabilities associated with the subcontractors, vendors, or service providers of an organization's direct third-party partners12. After contract signing and on-boarding due diligence is complete, the most important type of contract provision to manage Fourth-Nth party risk is subcontractor notice and approval.This provision requires the third party to inform the organization of any subcontracting arrangements and obtain the organization's consent before engaging any Fourth-Nth parties345. This provision enables the organization to have visibility and control over the extended network of suppliers and service providers, and to assess the potential risks and impacts of any outsourcing decisions.Subcontractor notice and approval also helps the organization to ensure that the Fourth-Nth parties comply with the same standards and expectations as the third party, and to hold the third party accountable for the performance and security of the Fourth-Nth parties345.Reference:

1: Understanding 4th- and Nth-Party Risk: What Do You Need to Know? | Mitratech

2: Understanding 4th- and Nth-Party Risk: What Do You Need to Know? | Mitratech Holdings, Inc - JDSupra

3: First, 2nd , 3rd , 4th, 5th Parties: How to Measure the Tiers of Risk

4: Managing 4th Party Risk with Vendor Insurance Verification - Evident ID

5: How to Write Fourth-Party Vendor Requirements Into the Contract - Venminder

Application security testing (AST) is a process of finding and eliminating vulnerabilities in software applications. There are different types of AST tools that can help with this process, such as static, dynamic, and interactive testing. Static testing analyzes the source code of the application without executing it, dynamic testing simulates attacks on the running application from the outside, and interactive testing combines both static and dynamic analysis to find more vulnerabilities and provide more context. Cookie consent scanning is not a type of AST, but rather a tool that checks if a website complies with the cookie consent regulations, such as the EU General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA). Cookie consent scanning does not test the security of the application, but rather the privacy and compliance of the website.Reference:

1: 10 Types of Application Security Testing Tools: When and How to Use Them

2: 5 Types of Application Security Testing You Must Know About

3: Types of Application Security Testing: Definitions and Differences

4: What is Application Security? | VMware Glossary

An outsourcer's vendor risk assessment process should include all the steps mentioned in options A, B, and C, as they are essential for ensuring a consistent, comprehensive, and effective evaluation of the vendor's performance, compliance, and risk profile. However, option D is not a necessary or recommended part of the vendor risk assessment process, as it does not reflect the actual level of risk posed by the vendor, but rather the availability of resources within the outsourcer's organization. Defining assessment frequency based on resource capacity could lead to under-assessing or over-assessing vendors, depending on the outsourcer's workload, budget, and staff. This could result in missing critical issues, wasting time and money, or creating gaps in the vendor oversight program. Therefore, option D is the correct answer, as it is the only one that does not belong to the vendor risk assessment process.Reference:The following resources support the verified answer and explanation:

Shared Assessments' CTPRP Job Guide, page 10, section 2.1.1, states that ''The frequency of assessments should be based on the risk tier of the third party, not on the availability of resources.''

Guide to Vendor Risk Assessment, section ''Step 3: Determine the Frequency of Vendor Risk Assessments'', explains that ''The frequency of vendor risk assessments should be based on the level of risk each vendor poses to your organization, not on the availability of resources or convenience.''

How to Conduct a Successful Vendor Risk Assessment in 9 Steps, section ''Step 8: Determine the Frequency of Vendor Risk Assessments'', advises that ''The frequency of vendor risk assessments should be based on the level of risk each vendor poses to your organization, not on the availability of resources or convenience.''

Workstation and endpoint security refers to the protection of devices that connect to a network from malicious actors and exploits1. These devices include laptops, desktops, tablets, smartphones, and IoT devices.Workstation and endpoint security can involve various measures, such as antivirus software, firewalls, encryption, authentication, patch management, and device management1.

Among the four options, the use of multi-tenant laptops poses the greatest risk potential for workstation and endpoint security.Multi-tenant laptops are laptops that are shared by multiple users or organizations, such as in a cloud-based environment2.This means that the laptop's resources, such as memory, CPU, storage, and network, are divided among different tenants, who may have different security policies, requirements, and access levels2. This can create several challenges and risks, such as:

Data leakage or theft: If the laptop is not properly isolated or encrypted, one tenant may be able to access or compromise another tenant's data or applications2. This can result in data breaches, identity theft, or compliance violations.

Malware infection or propagation: If one tenant's laptop is infected by malware, such as ransomware, spyware, or viruses, it may spread to other tenants' laptops through the shared network or storage2. This can disrupt the laptop's performance, functionality, or availability, and cause damage or loss of data or applications.

Resource contention or exhaustion: If one tenant's laptop consumes more resources than allocated, it may affect the performance or availability of other tenants' laptops2. This can result in slow response, poor user experience, or service degradation or interruption.

Configuration or compatibility issues: If one tenant's laptop has different or conflicting settings, preferences, or applications than another tenant's laptop, it may cause errors, crashes, or compatibility problems2. This can affect the laptop's functionality, reliability, or usability.

Therefore, the use of multi-tenant laptops should trigger more investigation due to greater risk potential, and require more stringent and consistent security controls, such as:

Segmentation or isolation: The laptop should be logically or physically separated into different segments or zones for each tenant, and restrict the communication or interaction between them2. This can prevent unauthorized access or interference between tenants, and limit the impact of a security incident to a specific segment or zone.

Encryption or obfuscation: The laptop should encrypt or obfuscate the data and applications of each tenant, and use strong encryption keys or algorithms2. This can protect the confidentiality and integrity of the data and applications, and prevent data leakage or theft.

Antivirus or anti-malware: The laptop should install and update antivirus or anti-malware software, and scan the laptop regularly for any malicious or suspicious activities2. This can detect and remove any malware infection or propagation, and prevent damage or loss of data or applications.

Resource allocation or management: The laptop should allocate or manage the resources of each tenant, and monitor the resource consumption and utilization2. This can ensure the performance or availability of the laptop, and prevent resource contention or exhaustion.

Configuration or standardization: The laptop should configure or standardize the settings, preferences, or applications of each tenant, and ensure the compatibility or interoperability between them2. This can avoid errors, crashes, or compatibility issues, and improve the functionality, reliability, or usability of the laptop.