Security Program Management and Oversight · Topic 4 of 7
Third-Party Risk Management
Security+ third party risk: vendor due diligence, right to audit, independent assessments, SLA, MSA, SOW, MOU, MOA, NDA and BPA agreements explained.
- 4 min
- Due diligence means researching a vendor before signing.
- A right to audit clause lets the customer inspect the vendor.
- Independent assessments are stronger evidence than self reported questionnaires.
What it is
Organizations rely on vendors, suppliers and service providers, and each one can bring risk. Third party risk management is the process of choosing partners carefully, setting terms in writing and checking them over time.
A supplier with weak security can expose your data. Your own controls may be strong, but you inherit the risk of the people who hold your data or build your systems.
How it works
Vendor assessment
Before and during a relationship, the organization checks the vendor. Several methods are named in the objective.
| Method | What it provides |
|---|---|
| Penetration testing | Shows how well the vendor's systems resist attack, with permission and defined limits |
| Right to audit clause | A contract term that lets the customer inspect the vendor's controls |
| Evidence of internal audits | Reports from the vendor's own checks |
| Independent assessments | Reports from an outside auditor, which carry more weight than self reports |
| Supply chain analysis | Looks at the vendor's own suppliers and their risks |
An independent report such as a System and Organization Controls (SOC) 2 report is a common form of evidence. A Type I report describes whether controls are suitably designed at one point in time, and a Type II report also tests how they operated over a period.
Vendor selection
Selection should include due diligence, which means researching the vendor's security, finances, reputation and legal position before signing. It should also look for conflicts of interest, such as a vendor that is owned by an official who influences the choice.
Agreement types
| Agreement | Purpose |
|---|---|
| Service level agreement (SLA) | Sets measurable service levels, such as uptime, often with penalties if they are missed |
| Memorandum of agreement (MOA) | A formal agreement on what each party will do |
| Memorandum of understanding (MOU) | A less formal statement of shared intent, usually not binding in the same way |
| Master service agreement (MSA) | General terms for a continuing relationship, under which separate jobs are agreed |
| Work order or statement of work (SOW) | The scope, deliverables and timeline for a specific job |
| Non disclosure agreement (NDA) | A promise to keep information confidential |
| Business partners agreement (BPA) | Defines how partners share profits, duties and decisions |
An MSA often sits above several SOWs. The MSA covers the legal terms once, and each SOW describes the work.
Vendor monitoring and questionnaires
Monitoring continues after the contract is signed. The organization reviews audit reports, checks that service levels are met, watches for news of breaches and repeats assessments on a schedule. Questionnaires collect information on a vendor's practices, though answers are self reported and may need evidence.
Rules of engagement
When a penetration test is allowed, the rules of engagement set what may be tested, when and by what methods. They protect both parties and prevent surprise damage or legal problems.
What to remember for the exam
- Due diligence means researching a vendor before signing.
- A right to audit clause lets the customer inspect the vendor.
- Independent assessments are stronger evidence than self reported questionnaires.
- An SLA sets measurable service levels. An NDA protects confidential information.
- An MSA covers general terms, and SOWs or work orders describe specific jobs.
- An MOU is less formal than an MOA or contract.
- Supply chain analysis looks at the vendor's own suppliers.
- Monitoring continues throughout the relationship, not only at selection.
If the question asks for a document that lists the scope, deliverables and schedule for one project, choose a statement of work.
Common mistakes
Trusting a questionnaire alone. It is a vendor's own statement, so ask for independent evidence.
Confusing SLA and MSA. The SLA sets service measures, while the MSA sets overall legal terms.
Mixing up MOU and MOA. The MOA is more formal and detailed. The MOU is a general statement of intent.
Checking only at the start. Vendors change, so reassess them regularly.
Ignoring the vendor's vendors. A subcontractor can be the weak link, so include fourth party risk in the review.
Penetration testing a vendor without written permission and rules of engagement can be illegal. Always get approval first.
Check yourself
What does a right to audit clause allow?
It lets the customer inspect or have an auditor inspect the vendor's controls.
Which agreement sets measurable service levels such as uptime?
A service level agreement (SLA).
What is the relationship between an MSA and a SOW?
The MSA sets the general terms of the relationship, and each SOW describes the scope of a specific piece of work under it.
Topic 4 of 7 in Security Program Management and Oversight
Test yourself on Security Program Management and Oversight
The full CompTIA Security+ SY0-701 question bank has 848 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.