2024 Easily pass CTPRP Exam with our Dumps & PDF Test Engine
CTPRP PDF Pass Leader, CTPRP Latest Real Test
NEW QUESTION # 15
Which statement BEST describes the methods of performing due diligence during third party risk assessments?
- A. Reviewing status of findings from the questionnaire and defining remediation plans
- B. interviewing subject matter experts or control owners, reviewing compliance artifacts, and validating controls
- C. Inspecting physical and environmental security controls by conducting a facility tour
- D. Reviewing and assessing only the obligations that are specifically defined in the contract
Answer: B
Explanation:
Performing due diligence during third party risk assessments is a process of verifying and validating the information provided by the third parties, as well as identifying and assessing any potential risks or issues that may arise from the relationship. Due diligence methods may vary depending on the type, scope, and complexity of the third party engagement, but they generally involve the following steps123:
* Interviewing subject matter experts or control owners: This method involves engaging with the relevant stakeholders from both the organization and the third party, such as business owners, project managers, legal counsel, compliance officers, security analysts, etc. The purpose of the interviews is to gather more information about the third party's capabilities, processes, policies, performance, and challenges, as well as to clarify any questions or concerns that may arise from the questionnaire or other sources. The interviews can also help to establish rapport and trust between the parties, and to identify any gaps or discrepancies in the information provided.
* Reviewing compliance artifacts: This method involves examining the evidence or documentation that supports the third party's claims or assertions, such as certifications, accreditations, audit reports, policies, procedures, contracts, SLAs, etc. The purpose of the review is to verify the accuracy, completeness, and validity of the artifacts, as well as to assess the level of compliance with the applicable standards, regulations, and best practices. The review can also help to identify any areas of improvement or weakness in the third party's controls or processes.
* Validating controls: This method involves testing or inspecting the actual implementation and effectiveness of the third party's controls or processes, such as security measures, quality assurance, data protection, incident response, etc. The purpose of the validation is to confirm that the controls are operating as intended and expected, and that they are sufficient to mitigate the risks or issues identified in the assessment. The validation can also help to identify any vulnerabilities or gaps in the third party's controls or processes.
The other options are not as comprehensive or accurate as the methods described above, as they may not cover all the aspects or dimensions of the third party risk assessment, or they may rely on incomplete or outdated information. Inspecting physical and environmental security controls by conducting a facility tour is only one part of the validation method, and it may not be applicable or feasible for all types of third parties, such as cloud service providers or remote workers. Reviewing status of findings from the questionnaire and defining remediation plans is more of a follow-up or monitoring activity, rather than a due diligence method, as it assumes that the questionnaire has already been completed and analyzed. Reviewing and assessing only the obligations that are specifically defined in the contract is a narrow and limited approach, as it may not capture the full scope or complexity of the third party relationship, or the dynamic and evolving nature of the risks or issues involved. References:
* Third Party Due Diligence - a vital but challenging process
* The guide to risk based third party due diligence - VinciWorks
* Third Party Risk Assessment - Checklist & Best Practices
NEW QUESTION # 16
Which example is typically NOT included in a Business Impact Analysis (BIA)?
- A. Prioritization of business functions and processes
- B. Including any contractual or legal/regulatory requirements
- C. Requiring vendor participation in testing
- D. Identifying the criticality of applications
Answer: C
Explanation:
A Business Impact Analysis (BIA) is a process of determining the criticality of business activities and associated resource requirements to ensure operational resilience and continuity of operations during and after a business disruption1. A BIA is used to identify the potential impacts of disruptions on business processes, such as lost sales, delayed revenue, increased expenses, regulatory fines, or contractual penalties2. A BIA is not concerned with the probability or causes of disruptions, but rather with the effects and consequences of disruptions3. Therefore, a BIA typically does not include requiring vendor participation in testing, as this is a part of the business continuity and disaster recovery planning and implementation, not the impact analysis. Vendor participation in testing is important to validate the effectiveness and alignment of the vendor's business continuity and disaster recovery plans with the organization's objectives and expectations, but it is not a component of the BIA itself. References: 1: Using Business Impact Analysis to Inform Risk Prioritization and Response 2: Business Impact Analysis (BIA): Prepare for Anything [2024] * Asana 3: The Difference Between a Vendor's BIA and Risk Analysis - Venminder : Best Practices Guidance for Third Party Risk
NEW QUESTION # 17
Which of the following components is NOT typically included in external continuous monitoring solutions?
- A. Status updates on localized events based on geolocation
- B. Metrics that track SLAs for performance management
- C. Alerts on legal and regulatory actions involving the vendor
- D. Reports that identify changes in vendor financial viability
Answer: B
Explanation:
External continuous monitoring solutions are tools or services that provide objective and timely data on the cybersecurity posture and performance of third-party vendors. They typically include components such as:
* Status updates on localized events based on geolocation, which can alert the organization to potential disruptions or incidents affecting the vendor's operations or infrastructure in a specific region or country12.
* Alerts on legal and regulatory actions involving the vendor, which can indicate the vendor's compliance status, reputation, or liability exposure13.
* Reports that identify changes in vendor financial viability, which can signal the vendor's ability to
* sustain its business operations, invest in security, or honor its contractual obligations14.
However, metrics that track SLAs for performance management are not typically included in external continuous monitoring solutions, as they are more relevant for internal monitoring and reporting. SLAs are service level agreements that define the expected quality, availability, and reliability of the vendor's services or products, as well as the penalties or remedies for non-compliance. SLAs are usually measured and reported by the vendor itself, or by a third-party auditor or assessor, based on the specific criteria and frequency agreed upon by the parties . Therefore, option C is the correct answer. References:
* Third Party Risk Management Framework, Module 5: Program Implementation, Section 5.2: Ongoing Monitoring, p. 32
* Bitsight Continuous Monitoring, Section: Uncover hidden risks
* Best-Practices Guidance for Third-Party Risk, Section: Monitor Third-Party Compliance with Regulations and Standards, p. 3
* Five Best Practices to Manage and Control Third-Party Risk, Section: Monitor Third-Party Financial Health, p. 4
* [Third Party Risk Management Framework], Module 4: Program Components, Section 4.3: Contracting, p. 24
* [A Better Way to Manage Third-Party Risk], Section: Establish clear service level agreements (SLAs) and key performance indicators (KPIs), p. 2
NEW QUESTION # 18
When conducting an assessment of a third party's physical security controls, which of the following represents the innermost layer in a 'Defense in Depth' model?
- A. Restricted entry
- B. Public internal
- C. Public external
- D. Private internal
Answer: D
Explanation:
In the 'Defense in Depth' security model, the innermost layer typically focuses on protecting the most sensitive and critical assets, which are often categorized as 'Private internal'. This layer includes security controls and measures that are designed to safeguard the core, confidential aspects of an organization's infrastructure and data. It encompasses controls such as access controls, encryption, and monitoring of sensitive systems and data to prevent unauthorized access and ensure data integrity and confidentiality. The
'Private internal' layer is crucial for maintaining the security of critical information and systems that are essential to the organization's operations and could have the most significant impact if compromised.
Implementing robust security measures at this layer is vital for mitigating risks associated with physical access to critical infrastructure and sensitive information.
References:
* Security frameworks and standards, including NIST SP 800-53 (Security and Privacy Controls for Federal Information Systems and Organizations) and the SANS Institute's guidelines on implementing
'Defense in Depth', provide detailed recommendations on securing the innermost layers of an organization's information systems.
* Publications such as "Physical Security Principles" by ASIS International offer insights into best practices for securing the private internal layer, including access control systems, surveillance, and intrusion detection mechanisms.
NEW QUESTION # 19
Which requirement is NOT included in IT asset end-of-life (EOL) processes?
- A. The requirement to establish defined procedures for secure destruction al sunset of asset
- B. The requirement to conduct periodic risk assessments to determine end-of-life
- C. The requirement to track status using a change initiation request form
- D. The requirement to track updates to third party provided systems or applications for any planned end-of-life support
Answer: B
Explanation:
In IT asset end-of-life (EOL) processes, the requirement to conduct periodic risk assessments specifically to determine end-of-life is not typically included. EOL processes generally focus on managing the decommissioning and secure disposal of IT assets that have reached the end of their useful life or support period. This includes tracking the status of assets, managing updates and support for third-party systems and applications, and establishing procedures for the secure destruction of assets at sunset. While risk assessments are crucial in overall IT asset management, they are not usually a direct component of determining an asset's EOL status, which is more often based on operational effectiveness, manufacturer support, and technological obsolescence.
References:
* IT asset management and disposal best practices, such as those outlined in the NIST Guidelines for Media Sanitization (NIST SP 800-88), focus on the secure and environmentally responsible disposal of IT assets without specifically mandating periodic risk assessments for EOL determination.
* The "IT Asset Disposal (ITAD) Best Practice Guide" by the International Association of IT Asset Managers (IAITAM) provides insights into effective EOL processes, including tracking, updating, and securely destroying IT assets.
NEW QUESTION # 20
Which TPRM risk assessment component would typically NOT be maintained in a Risk Register?
- A. An outline of proposed mitigation actions and assignment of risk owner
- B. A grading of each risk according to a risk assessment table or hierarchy
- C. An assessment of the impact and likelihood the risk will occur and the possible seriousness
- D. Vendor inventory of all suppliers, vendors, and service providers prioritized by contract value
Answer: D
Explanation:
A risk register is a tool that records and tracks the identified risks, their probability, impact, status, and mitigation actions throughout the life cycle of a third-party relationship1. A risk register typically includes the following components2:
* A unique identifier for each risk
* A description of the risk and its source
* A rating or grading of the risk according to a risk assessment table or hierarchy
* An assessment of the impact and likelihood the risk will occur and the possible seriousness
* An outline of proposed mitigation actions and assignment of risk owner
* A status update on the risk and the progress of the mitigation actions
* A target date for resolving the risk or closing the action A vendor inventory is a list of all the third parties that a banking organization engages with, along with relevant information such as the type, scope, and nature of the services provided, the contract terms and conditions, the performance indicators, and the risk ratings3. A vendor inventory is not a component of a risk register, but rather a separate document that supports the planning and due diligence phases of the third-party relationship life cycle. A vendor inventory may be prioritized by contract value, but also by other criteria such as the criticality of the service, the risk level of the vendor, and the strategic importance of the relationship.
References:
* 1: Third-Party Risk Management (TPRM): Final Interagency Guidance, KPMG, June 2023
* 2: What Is Third-Party Risk Management (TPRM)? 2024 Guide, UpGuard, January 2024
* 3: Third-Party Risk Management Guidance, OCC Bulletin 2023-29, October 2023
* [4]: Certified Third Party Risk Professional (CTPRP) Study Guide, Shared Assessments, 2023
* [5]: Best Practices Guidance for Third-Party Risk, GARP, February 2023
NEW QUESTION # 21
Tracking breach, credential exposure and insider fraud/theft alerts is an example of which continuous monitoring technique?
- A. Passive and active indicators of compromise
- B. Business intelligence
- C. Vulnerabilities
- D. Monitoring surface
Answer: A
Explanation:
Continuous monitoring is a process of collecting and analyzing data on the performance and security of third-party vendors on an ongoing basis. Continuous monitoring helps to identify and mitigate potential risks, such as data breaches, credential exposures, insider fraud/theft, and other cyber incidents, that may affect the organization and its customers. Continuous monitoring can use various techniques, such as monitoring surface, vulnerabilities, passive and active indicators of compromise, and business intelligence.
Passive and active indicators of compromise are examples of continuous monitoring techniques that track the signs of malicious activity or compromise on the third-party vendor's systems or networks. Passive indicators of compromise are data sources that do not require direct interaction with the target, such as threat intelligence feeds, dark web monitoring, or external scanning. Active indicators of compromise are data sources that require direct interaction with the target, such as penetration testing, malware analysis, or incident response.
Both passive and active indicators of compromise can provide valuable information on the current state and potential threats of the third-party vendor's environment.
The other options are not examples of continuous monitoring techniques that track breach, credential exposure and insider fraud/theft alerts. Monitoring surface is a technique that measures the size and complexity of the third-party vendor's attack surface, such as the number and type of internet-facing assets, domains, and services. Vulnerabilities are a technique that identifies the weaknesses or flaws in the third-party vendor's systems or applications that can be exploited by attackers, such as outdated software, misconfigurations, or unpatched bugs. Business intelligence is a technique that analyzes the business performance and reputation of the third-party vendor, such as financial stability, customer satisfaction, or regulatory compliance. References:
* Guide: Continuous Monitoring for Third-Party Risk
* Continuous Monitoring - Third Party Risk Management
* 12 Ongoing Monitoring Best Practices for Third-Party Risk Management
NEW QUESTION # 22
The primary disadvantage of Single Sign-On (SSO) access control is:
- A. The impact of a compromise of the end-user credential that provides access to multiple systems is greater
- B. Vendors must develop multiple methods to integrate system access adding cost and complexity
- C. Users store multiple passwords in a single repository limiting the ability to change the password
- D. A single password is easier to guess and be exploited
Answer: A
Explanation:
Single Sign-On (SSO) is a convenient and efficient way of authenticating users across multiple applications and platforms with a single set of credentials. However, it also poses some security risks and challenges that need to be considered and addressed. One of the main disadvantages of SSO is that it creates a single point of failure and a high-value target for attackers. If an end-user credential is compromised, the attacker can gain access to all the systems and resources that the user is authorized to access, potentially causing significant damage and data breaches. Therefore, SSO requires strong security measures to protect the user credentials, such as encryption, multifactor authentication, password policies, and monitoring. Additionally, SSO users need to be aware of the risks and follow best practices to safeguard their credentials, such as using strong and unique passwords, changing them regularly, and avoiding phishing and social engineering attacks.
References:
* 1: What are the disadvantages of single sign-on authentication? - Information Security Stack Exchange
* 2: Single Sign-On Disadvantages: 6 Advantages and Disadvantages [What You Need to Know] - Mostly Blogging
* 3: SSO Security Risks: The Drawbacks of SSO (And What Can You Do About it) - Zluri
NEW QUESTION # 23
Which of the following BEST reflects the risk of a 'shadow IT" function?
- A. inability to prevent "shadow IT' functions from using unauthorized software solutions
- B. Failure to implement strong security controls because IT is executed remotely
- C. "Shadow IT" functions often lack governance and security oversight
- D. "Shadow IT" functions often fail to detect unauthorized use of information assets
Answer: C
Explanation:
Shadow IT refers to the use of IT systems, services, or devices that are not authorized, approved, or supported by the official IT department. Shadow IT can pose significant risks to an organization's data security, compliance, performance, and reputation. One of the main risks of shadow IT is that it often lacks governance and security oversight. This means that the shadow IT functions may not follow the established policies, standards, and best practices for IT management, such as data protection, access control, encryption, backup, patching, auditing, and reporting. This can expose the organization to various threats, such as data breaches, cyberattacks, malware infections, legal liabilities, regulatory fines, and reputational damage. Additionally, shadow IT can create operational inefficiencies, compatibility issues, duplication of efforts, and increased costs for the organization.
According to the web search results from the search_web tool, shadow IT is a common and growing phenomenon in many organizations, especially with the proliferation of cloud-based services and applications. Some of the articles suggest the following best practices for managing and mitigating shadow IT risks123:
* Performing SaaS assessments to proactively detect shadow IT
* Prioritizing user experience (UX) and providing support for integrating tools
* Streamlining user account and identity management
* Using operating systems and devices with which employees are comfortable
* Compromising and collaborating with users to minimize shadow IT risks
* Educating and training users on the security risks and consequences of shadow IT
* Establishing clear policies and guidelines for IT procurement and usage
* Creating a culture of trust and transparency between IT and business units Therefore, the verified answer to the question is B. "Shadow IT" functions often lack governance and security oversight.
References:
* Shadow IT Explained: Risks & Opportunities - BMC Software
* Start reducing your organization's Shadow IT risk in 3 steps
* What is shadow IT? - Article | SailPoint
NEW QUESTION # 24
Which of the following statements is FALSE regarding a virtual assessment:
- A. Virtual assessments should be used to validate or confirm understanding of key controls, and not be used simply to review questionnaire responses
- B. Virtual assessment planning should identify what documentation is available for review prior to and during the assessment
- C. Virtual assessment agendas and planning should identify who should be available for interviews
- D. Virtual assessments include using interviews with subject matter experts since controls evaluation and testing cannot be performed virtually
Answer: D
Explanation:
Virtual assessments are a method of conducting third party risk assessments remotely, using various tools and techniques to collect and verify information about the third party's controls, processes, and performance.
Virtual assessments can be used to evaluate various risk domains, such as information security, privacy, resiliency, and compliance, depending on the scope and objectives of the assessment. Virtual assessments can also be used to complement or supplement onsite assessments, especially when travel or access restrictions are in place.
One of the key components of virtual assessments is the use of interviews with subject matter experts (SMEs) from the third party, who can provide insights and clarifications on the third party's policies, procedures, practices, and evidence. Interviews can also be used to validate or confirm the understanding of key controls, and not just to review questionnaire responses. However, interviews are not the only way to perform controls evaluation and testing in virtual assessments. Other methods include:
* Requesting and reviewing documentation and artifacts from the third party, such as policies, standards, certifications, attestations, test results, audit reports, or incident logs, that demonstrate the implementation and effectiveness of the controls.
* Performing live or recorded demonstrations of the controls, such as showing how the third party monitors, detects, and responds to security incidents, or how the third party encrypts, backs up, and restores data.
* Using remote access tools or platforms, such as screen sharing, video conferencing, or web portals, to observe and verify the controls in action, such as checking the configuration settings, access rights, or patch levels of the third party's systems or applications.
* Using independent or external sources of information, such as ratings, benchmarks, or feedback, to validate and compare the third party's performance, compliance, or reputation.
Therefore, the statement that virtual assessments include using interviews with SMEs since controls evaluation and testing cannot be performed virtually is false, as there are other ways to perform controls evaluation and testing in virtual assessments, besides interviews.
References:
* 1: Shared Assessments, a leading provider of third party risk management solutions, offers a comprehensive guide for Certified Third Party Risk Professional (CTPRP) candidates, which covers the core concepts and best practices of third party risk management, including virtual assessments.
* 2: Schneider Downs, a professional services firm, provides a blog post on the best practices for conducting third party risk management virtual assessments, which includes the methods and steps for performing controls evaluation and testing remotely.
* 3: Shared Assessments, a leading provider of third party risk management solutions, offers a blog post on the value and challenges of virtual assessments, which includes the benefits and drawbacks of using interviews and other techniques for controls evaluation and testing.
NEW QUESTION # 25
Which approach demonstrates GREATER maturity of physical security compliance?
- A. Leveraging periodic reporting to schedule facility inspections based on reported events
- B. Maintaining a standardized scheduled for confirming controls to defined standards
- C. Conducting unannounced checks an an ac-hac basis
- D. Providing a checklist for self-assessment
Answer: B
Explanation:
According to the Shared Assessments Certified Third Party Risk Professional (CTPRP) Study Guide, physical security compliance is the process of ensuring that the physical assets and personnel of an organization are protected from unauthorized access, theft, damage, or harm1. Physical security compliance can be achieved by implementing various measures, such as locks, alarms, cameras, guards, fences, badges, etc. However, these measures need to be regularly monitored, tested, and verified to ensure their effectiveness and alignment with the defined standards and policies2. Therefore, maintaining a standardized schedule for confirming controls to defined standards demonstrates a greater maturity of physical security compliance, as it indicates a proactive and consistent approach to assessing and improving the physical security posture of an organization3.
The other options do not reflect a high level of physical security compliance maturity, as they either rely on reactive or ad hoc methods, or lack sufficient verification and validation mechanisms. Leveraging periodic reporting to schedule facility inspections based on reported events may indicate a lack of preventive and predictive measures, as well as a dependency on external or internal incidents to trigger the inspections.
Providing a checklist for self-assessment may indicate a lack of independent and objective evaluation, as well as a potential for bias or error in the self-assessment process. Conducting unannounced checks on an ad hoc basis may indicate a lack of planning and coordination, as well as a potential for disruption or inconsistency in the checks.
References:
* 1: Shared Assessments Certified Third Party Risk Professional (CTPRP) Study Guide, page 24
* 2: Physical Security: Planning, Measures & Examples + PDF - Avigilon
* 3: Security Maturity Models: Levels, Assessment, and Benefits
* [4]: Best Practices for Planning and Managing Physical Security Resources - CISA, page 10
* [5]: Self-Assessment vs. Independent Assessment: What's the Difference? | Linford & Company LLP
* [6]: The Pros and Cons of Unannounced Audits | NQA
NEW QUESTION # 26
Which statement is FALSE regarding background check requirements for vendors or service providers?
- A. Background checks should be performed prior to employment and may be updated after employment based upon criteria in HR policies
- B. Background check requirements should be applied to employees, contract workers and temporary workers
- C. Background check requirements are not applicable for vendors or service providers based outside the United States
- D. Background check requirements may differ based on level of authority, risk, or job role
Answer: C
Explanation:
Background check requirements are applicable for vendors or service providers based outside the United States, as well as those based within the country. According to the Shared Assessments Program, background checks are a key component of third-party risk management and should be conducted for all third parties that have access to sensitive data, systems, or facilities, regardless of their location1. The FCRA also applies to background checks performed by U.S. employers on foreign nationals who work outside the U.S. for a
U.S. employer or its affiliates2. Therefore, statement A is false and the correct answer is A. References:
* Shared Assessments Program: Third Party Risk Management Fundamentals
* Background Checks for Contractors or Vendors
NEW QUESTION # 27
Which statement is NOT an example of the purpose of internal communications and information sharing using TPRM performance metrics?
- A. To communicate the status of policy compliance with TPRM onboarding, periodic assessment and off-boarding requirements
- B. To document the agreed upon corrective action plan between external parties based on the severity of findings
- C. To communicate the status of findings identified in vendor assessments and escalate issues es needed
- D. To develop and provide periodic reporting to management based on TPRM results
Answer: B
Explanation:
The purpose of internal communications and information sharing using TPRM performance metrics is to inform and align the organization's stakeholders on the status, progress, and outcomes of the TPRM program.
This includes communicating the results of vendor assessments, the compliance level of the organization's policies and procedures, and the periodic reporting to management and other relevant parties. However, documenting the corrective action plan between external parties is not an internal communication, but rather an external one. This is because the corrective action plan is a formal agreement between the organization and the vendor to address and resolve the issues identified in the assessment. Therefore, this statement is not an example of the purpose of internal communications and information sharing using TPRM performance metrics. References:
* 15 KPIs & Metrics to Measure the Success of Your TPRM Program
* Third-party risk management metrics: Best practices to enhance your program
* 3 Best Third-Party Risk Management Software Solutions (2024)
NEW QUESTION # 28
Minimum risk assessment standards for third party due diligence should be:
- A. Identified by procurement and required for all vendors and suppliers
- B. Set by each business unit based on the number of vendors to be assessed
- C. Defined in the vendor/service provider contract or statement of work
- D. Established by the TPRM program based on the company's risk tolerance and risk appetite
Answer: D
Explanation:
According to the CTPRP Job Guide, the TPRM program should establish minimum risk assessment standards for third party due diligence based on the company's risk tolerance and risk appetite. This means that the TPRM program should define the scope, depth, frequency, and methodology of the risk assessment process for different categories of third parties, taking into account the potential impact and likelihood of various risks.
The risk assessment standards should be consistent, transparent, and aligned with the company's strategic objectives and regulatory obligations. The TPRM program should also monitor and update the risk assessment standards as needed to reflect changes in the business environment, risk profile, and best practices. The other options are not correct because they do not reflect a holistic and risk-based approach to third party due diligence. Setting the standards by each business unit may result in inconsistency, duplication, or gaps in the risk assessment process. Defining the standards in the contract or statement of work may limit the flexibility and adaptability of the risk assessment process to changing circumstances. Identifying the standards by procurement may overlook the input and involvement of other stakeholders and functions in the risk assessment process. References:
* CTPRP Job Guide, page 17
* Third-Party Risk Management and ISO Requirements for 2022, section "Benefits of Implementing Risk Management"
* Managing third-party risk through effective due diligence, section "Complying with regulators' demands"
* Third-Party Due Diligence Checklist: 3 Essential Steps, section "Step 2: Conduct a Risk Assessment"
NEW QUESTION # 29
Which of the following methods of validating pre-employment screening attributes is appropriate due to limitations of international or state regulation?
- A. Requiring evidence of drug testing
- B. Providing and sampling complete personnel files to demonstrate unique screening results
- C. Reviewing evidence of web search of social media sites
- D. Requesting evidence of the performance of pre-employment screening when permitted by law
Answer: D
Explanation:
it is the most appropriate and compliant method of validating pre-employment screening attributes among the given options. Requesting evidence of the performance of pre-employment screening when permitted by law means that the organization respects the legal and regulatory boundaries of different jurisdictions and does not impose unnecessary or unlawful requirements on its third parties. It also ensures that the organization obtains relevant and reliable information about the third parties' screening processes and outcomes, which can help assess their suitability and risk level.
The other options are incorrect because they are either inappropriate or ineffective methods of validating pre-employment screening attributes. Reviewing evidence of web search of social media sites (A) is inappropriate because it may violate the privacy and data protection rights of the third parties and their employees, as well as expose the organization to potential bias and discrimination claims. Providing and sampling complete personnel files to demonstrate unique screening results (B) is ineffective because it may not reflect the actual screening attributes of the third parties, as they may have different screening criteria, standards, and methods than the organization. Requiring evidence of drug testing is inappropriate because it may not be relevant or necessary for the nature and scope of the third-party relationship, and it may also conflict with the laws and regulations of different jurisdictions that prohibit or limit such testing. References:
https://www.onetrust.com/blog/third-party-risk-management/
NEW QUESTION # 30
......
CTPRP Dumps Ensure Your Passing: https://actualtests.test4engine.com/CTPRP-real-exam-questions.html