CoreQ Academy My progress Sign in
Security+ level · Domain 5.0 Security Program Management and Oversight · 20% of the mapped exam

5.3 Explain the processes associated with third-party risk assessment and management.

17 topics · 4 quiz questions

Your vendors' security is your security. Assess them before you sign, put the right agreements in place, and keep monitoring.

Vendor assessment

Penetration testing
Testing a vendor's systems, or requiring their own test results.
Right-to-audit clause
Contract term letting you audit the vendor's security.
Evidence of internal audits
Vendor shares results of its own audits.
Independent assessments
Third-party reports such as SOC 2 Type II or ISO 27001 certification.
Supply chain analysis
Understanding the vendor's own suppliers and dependencies.

Vendor selection

Due diligence
Investigating a vendor's security, finances and reputation before contracting.
Conflict of interest
Checking that decision-makers have no personal stake in the vendor.

Agreement types

Service-level agreement (SLA)
Defines measurable service levels (uptime, response times) and penalties.
Memorandum of agreement (MOA)
Formal document describing cooperative responsibilities; more binding than an MOU.
Memorandum of understanding (MOU)
Statement of intent between parties; generally not legally binding.
Master service agreement (MSA)
Umbrella contract with general terms; individual projects are added under it.
Work order (WO)/statement of work (SOW)
Defines the specific work, deliverables, timeline and cost for a project.
Non-disclosure agreement (NDA)
Legally binds parties to keep information confidential.
Business partners agreement (BPA)
Defines how business partners share profits, responsibilities and decisions.

Ongoing management

Vendor monitoring
Continuously checking vendor security posture, incidents and compliance.
Questionnaires
Structured security questions vendors answer (for example SIG, CAIQ).
Rules of engagement
Defines what testers may and may not do during an assessment, including scope and timing.

Check your understanding

Knowledge quiz · pass mark 80%
  1. An MOU is usually more legally binding than an MOA.
  2. Which agreement defines 99.9% uptime and penalties for missing it?
  3. Which contract clause lets you inspect a vendor's security controls?
  4. An umbrella contract with general terms under which projects are added is an:

Original CoreQ Academy material, mapped to objective 5.3 of the publicly available CompTIA Security+ SY0-701 exam objectives (Exam objectives V7, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.