Shared Assessments CTPRP Exam Questions

Threat modeling is a core element of the Microsoft Security Development Lifecycle (SDL) and a structured approach to identify, quantify, and address the security risks associated with an application12.Threat modeling helps to shape the application's design, meet the security objectives, and reduce risk1. The best time to perform threat modeling analysis is before the application design and development activities begin, as this allows the application service provider to:

Communicate about the security design of their systems1.

Analyze the design for potential security issues using a proven methodology1.

Suggest and manage mitigations for security issues1.

Incorporate security requirements into the design2.

Avoid costly rework or redesign later in the SDLC2.

Identify the most critical and relevant threats to focus on2.Reference:1: Microsoft Security Development Lifecycle Threat Modelling12: Threat Modeling Process | OWASP Foundation2

A risk register is a tool that records and tracks the identified risks, their probability, impact, status, and mitigation actions throughout the life cycle of a third-party relationship1.A risk register typically includes the following components2:

A unique identifier for each risk

A description of the risk and its source

A rating or grading of the risk according to a risk assessment table or hierarchy

An assessment of the impact and likelihood the risk will occur and the possible seriousness

An outline of proposed mitigation actions and assignment of risk owner

A status update on the risk and the progress of the mitigation actions

A target date for resolving the risk or closing the action A vendor inventory is a list of all the third parties that a banking organization engages with, along with relevant information such as the type, scope, and nature of the services provided, the contract terms and conditions, the performance indicators, and the risk ratings3. A vendor inventory is not a component of a risk register, but rather a separate document that supports the planning and due diligence phases of the third-party relationship life cycle. A vendor inventory may be prioritized by contract value, but also by other criteria such as the criticality of the service, the risk level of the vendor, and the strategic importance of the relationship.Reference:

1: Third-Party Risk Management (TPRM): Final Interagency Guidance, KPMG, June 2023

2: What Is Third-Party Risk Management (TPRM)? 2024 Guide, UpGuard, January 2024

3: Third-Party Risk Management Guidance, OCC Bulletin 2023-29, October 2023

[4]: Certified Third Party Risk Professional (CTPRP) Study Guide, Shared Assessments, 2023

[5]: Best Practices Guidance for Third-Party Risk, GARP, February 2023

Fourth-Nth party risk refers to the potential threats and vulnerabilities associated with the subcontractors, vendors, or service providers of an organization's direct third-party partners12. After contract signing and on-boarding due diligence is complete, the most important type of contract provision to manage Fourth-Nth party risk is subcontractor notice and approval.This provision requires the third party to inform the organization of any subcontracting arrangements and obtain the organization's consent before engaging any Fourth-Nth parties345. This provision enables the organization to have visibility and control over the extended network of suppliers and service providers, and to assess the potential risks and impacts of any outsourcing decisions.Subcontractor notice and approval also helps the organization to ensure that the Fourth-Nth parties comply with the same standards and expectations as the third party, and to hold the third party accountable for the performance and security of the Fourth-Nth parties345.Reference:

1: Understanding 4th- and Nth-Party Risk: What Do You Need to Know? | Mitratech

2: Understanding 4th- and Nth-Party Risk: What Do You Need to Know? | Mitratech Holdings, Inc - JDSupra

3: First, 2nd , 3rd , 4th, 5th Parties: How to Measure the Tiers of Risk

4: Managing 4th Party Risk with Vendor Insurance Verification - Evident ID

5: How to Write Fourth-Party Vendor Requirements Into the Contract - Venminder

Application security testing (AST) is a process of finding and eliminating vulnerabilities in software applications. There are different types of AST tools that can help with this process, such as static, dynamic, and interactive testing. Static testing analyzes the source code of the application without executing it, dynamic testing simulates attacks on the running application from the outside, and interactive testing combines both static and dynamic analysis to find more vulnerabilities and provide more context. Cookie consent scanning is not a type of AST, but rather a tool that checks if a website complies with the cookie consent regulations, such as the EU General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA). Cookie consent scanning does not test the security of the application, but rather the privacy and compliance of the website.Reference:

1: 10 Types of Application Security Testing Tools: When and How to Use Them

2: 5 Types of Application Security Testing You Must Know About

3: Types of Application Security Testing: Definitions and Differences

4: What is Application Security? | VMware Glossary

An outsourcer's vendor risk assessment process should include all the steps mentioned in options A, B, and C, as they are essential for ensuring a consistent, comprehensive, and effective evaluation of the vendor's performance, compliance, and risk profile. However, option D is not a necessary or recommended part of the vendor risk assessment process, as it does not reflect the actual level of risk posed by the vendor, but rather the availability of resources within the outsourcer's organization. Defining assessment frequency based on resource capacity could lead to under-assessing or over-assessing vendors, depending on the outsourcer's workload, budget, and staff. This could result in missing critical issues, wasting time and money, or creating gaps in the vendor oversight program. Therefore, option D is the correct answer, as it is the only one that does not belong to the vendor risk assessment process.Reference:The following resources support the verified answer and explanation:

Shared Assessments' CTPRP Job Guide, page 10, section 2.1.1, states that ''The frequency of assessments should be based on the risk tier of the third party, not on the availability of resources.''

Guide to Vendor Risk Assessment, section ''Step 3: Determine the Frequency of Vendor Risk Assessments'', explains that ''The frequency of vendor risk assessments should be based on the level of risk each vendor poses to your organization, not on the availability of resources or convenience.''

How to Conduct a Successful Vendor Risk Assessment in 9 Steps, section ''Step 8: Determine the Frequency of Vendor Risk Assessments'', advises that ''The frequency of vendor risk assessments should be based on the level of risk each vendor poses to your organization, not on the availability of resources or convenience.''