Third-Party and Supply Chain Risk
What to know
Third-party risk management spans the full lifecycle: due diligence before onboarding, contractual controls, ongoing monitoring, and offboarding. Candidates should understand tiering vendors by criticality and data access, the role of security questionnaires and independent reports (SOC 2, ISO certificates), right-to-audit clauses, subprocessor approval, data processing agreements, and concentration risk (over-reliance on a single provider). Understand fourth-party risk - your vendor's vendors - and the need for flow-down obligations. Supply chain security also includes software provenance, secure development, and integrity of components.
Traps
A common trap is treating a vendor's certification as blanket assurance: scope, period, and exceptions matter. Another is assuming the vendor's security posture is static - monitoring must be continuous. Watch for the distinction between contractual obligations (what you can enforce) and assurance (what you can verify). Also beware of accepting a vendor's self-attestation as equivalent to independent testing for high-criticality vendors.
Worked example / rule of thumb
A payroll provider processes employee data. Due diligence: SOC 2 Type II review, security questionnaire, subprocessor list. Contract: DPA, breach notification timeline, right to audit, termination and data return. Monitoring: annual report review and periodic reassessment. Rule of thumb: the higher the data sensitivity and operational dependency, the stronger the evidence and the tighter the contract.
Exam focus
Expect lifecycle-stage questions and scenarios testing whether a given assurance artifact is sufficient for a vendor tier.