- Welcome to lesson 25, deep dive quiz.
Now, lesson 25 was all about explaining the processes
associated with third-party risk assessment and management.
And we only had one lesson, 25.1,
which was third-party risk management.
So now together, we're gonna do a five-question quiz.
You know how to do this.
Let's make sure you have a pen or a pencil,
a piece of paper.
Put me on pause as often as you need to,
so that you can dive right in and answer these questions.
Are you ready? Let's go.
Your organization is moving its data center to the cloud.
Uptime is critical.
What type of agreement is used
to codify service requirements and consequences?
A BAA, an AUP, an SLA, or an MOU.
Again, you may get acronyms, right, in your exam,
so be ready for that.
A BAA, an AUP, an SLA, or an MOU.
What are you gonna choose?
I'm gonna go right for our SLA
that stands for service-level agreement, right?
That's gonna be the type of agreement
that will codify our service requirements and consequences,
which could be rewards or penalties.
Let's check, and that is correct.
Question two, which group would not,
not being the important word here,
not be considered a third party?
An MSPs, work-from-home employees,
consultants, or contractors.
This is a great example of what would happen
if you read a question too fast
and then answered the first, you know,
chose the first answer that you liked.
Because if you read it
as which group would be considered a third party
and you got to MSPs,
you might say, "Oh, yeah, there you go, done."
Moving on to the next.
So make sure of two things, right?
You're reading carefully for comprehension
and that you read every answer option.
So which group would not be considered a third party?
Well, MSPs, definitely a third party,
consultants, they're a third party,
contractors, they're a third party, right?
None of them are considered your employees.
How about our work-from-home employees?
They would not be considered a third party.
Agree? Let's check.
There you go.
Your organization is negotiating a contract
with a new vendor.
A sticking point
is that they refuse to include a right to audit clause.
What might be an acceptable alternative?
Choose all that apply.
So what might you accept?
An internal security report, an industry certification,
so perhaps you've been certified by ISO
or another industry certification for the organization,
maybe PCI DSS certification,
an SSAE 18 audit report,
or an independent, meaning a third party,
security assessment?
What might you accept?
And not allowing you to come in and audit,
but what would you accept in lieu of that?
Well, here's what we probably wouldn't accept,
an internal security report.
Industry certification, we might, right,
depending on how robust it is.
An SSAE 18 audit report, probably,
and an independent security assessment
done by a reputable firm, we'd probably accept that as well.
What we wouldn't accept is their internal security report.
Do you agree?
Okay, let's check.
And that is correct.
All right, we're gonna match the agreement
and the description,
and our agreements are an MSA, an MOA, an MOU, or an NDA.
A master services agreement,
a memorandum of agreement,
a memorandum of understanding, or an NDA.
On the right hand side,
we have a framework for future projects,
non-binding outline agreement,
establishes data ownership and control,
or a legally enforceable agreement
that establishes a relationship.
Go ahead and put me on pause and match these up.
All right, well, let's start right up on top.
A framework for future projects.
Oh, it's right there.
That's probably gonna be a master services agreement.
A non-binding outline agreement,
an agreement sort of outlines
what the relationship is gonna be,
but the key is it is non-binding.
That's gonna be an MOU, a memorandum of understanding.
We have an understanding, but it's not legally binding.
Establishes data control and ownership.
Oh, we're gonna come right down here
to our NDA, our non-disclosure agreement,
and that leaves for MOA, memorandum of agreement,
our legally enforceable agreement
that establishes a relationship.
So let's review these.
An MSA, a framework for future projects.
An MOA, a legally enforceable agreement
that establishes a relationship.
An MOU, a non-binding outline agreement,
and an NDA, which establishes data ownership control.
Agree?
All right, let's check and that is perfect.
Good work.
All right, we are going to choose the correct answer
in the dropdown box,
and these are going to be true or false.
Compliance responsibility can be outsourced
to third parties.
Incident management protocols should be included
in third-party contracts.
Fourth-parties are subservice organizations
of third parties,
or due diligence should be limited
to the initial investigation.
So the first one's interesting.
Compliance responsibility, not compliance actions,
but responsibility for compliance can be outsourced
to a third party.
What do you think? True or false?
That's gonna be absolutely false, right?
We can require, right, that our third parties comply
with all of our compliance requirements,
but ultimately, the responsibility for compliance
can't be outsourced.
The responsibility for compliance
will still be maintained by the organization.
You can never say to your oversight body,
"Oh, well, it wasn't us, it was my vendor."
They're gonna say,
"Yeah, but you are responsible for your vendor.
You have the compliance responsibility."
So we're gonna say false on that one.
All right. How about the next one?
Incident management protocols should be included
in third-party contracts.
Do you wanna put that in your contract?
True or false?
Ah, I really like that one.
Absolutely true.
All right, we really wanna say this is how incidents
are gonna be handled.
This is how quickly we wanna be notified.
This is who you're gonna notify,
and this is the protocol that we're gonna follow.
All right, next one.
Fourth parties are subservice organizations
of a third party.
Is that true or false?
Well, that's definitely true, right?
That is our definition of a fourth party.
All right, lastly, due diligence should be limited
to the initial investigation.
What do you think?
Well, we do wanna do due diligence
during the initial investigation,
but do we wanna do due diligence other times?
Absolutely.
How about during the life of the relationship
and especially whenever there's a new contract to be signed?
So true or false?
That is gonna be false.
So we have false.
We have compliance responsibility can be outsourced
to third parties, false.
Incident management protocols should be included
in third-party contracts, true.
Fourth parties are subservice organizations
of third parties, true.
And due diligence should be limited
to the initial investigation, false.
Do you agree?
Okay, let's check and we are correct.
Awesome. Another great job.
You guys are cool.
All right, next up, lesson 26,
summarize the elements of effective security compliance.
I'll see you there.