Security Program Management and Oversight · Topic 4 of 7
Third-Party Risk Management
Security+ third-party risk: RFP, RFI, RFQ, due diligence, SLA, SLO, MSA, SOW, MOU, MOA and NDA, vendor monitoring, constraints and rules of engagement.
- 5 min
- An RFI gathers information, an RFP asks for a detailed proposal and an RFQ asks for a price.
- Due diligence means researching a vendor before signing.
- An MSA sets general terms, and each SOW describes a specific job.
What it is
Organizations rely on vendors, suppliers and service providers, and each one can bring risk. Third-party risk management is choosing partners carefully, setting terms in writing and checking them for as long as the relationship lasts.
Your own controls may be strong, but you inherit the risk of everyone who holds your data or runs your systems.
How it works
Vendor selection
| Item | Meaning |
|---|---|
| Expression of interest (EOI) | An early invitation for vendors to say they are interested and able, used to build a shortlist |
| Request for information (RFI) | Asks vendors for general information about their products and capabilities |
| Request for proposal (RFP) | Asks vendors for a detailed proposal for how they would meet stated requirements, including price |
| Request for quote (RFQ) | Asks for a price when the goods or services are already clearly defined |
| Due diligence | Researching the vendor's security, finances, reputation and legal position before signing |
| Conflict of interest | A personal or business tie that could bias the choice, which must be disclosed and managed |
Security requirements belong in the RFP itself. It is much easier to require a control before the contract than to add it later.
Agreement types
| Agreement | Purpose |
|---|---|
| Master services agreement (MSA) | General legal terms for a continuing relationship, under which separate jobs are agreed |
| Statement of work (SOW) | The scope, deliverables and timeline for one specific job |
| Service-level agreement (SLA) | The service levels promised, often with penalties if they are missed |
| Service-level objective (SLO) | One measurable target within an SLA, such as 99.9 percent monthly uptime |
| Memorandum of understanding (MOU) | A less formal statement of shared intent, usually not legally binding |
| Memorandum of agreement (MOA) | A more formal agreement on what each party will do |
| Non-disclosure agreement (NDA) | A promise to keep shared information confidential |
The SLA is the agreement, and each SLO is a number inside it. If the SLO says 99.9 percent uptime and the vendor delivers 99.5 percent, the SLA penalty applies.
Vendor monitoring
| Method | What it provides |
|---|---|
| Right to audit | A contract clause that lets the customer, or its auditor, inspect the vendor's controls |
| Service-level monitoring | Measuring actual performance against the SLOs |
| Vendor registry | A central list of all vendors, what they supply, what data they access and their risk level |
| Vendor assessment | A review of the vendor's security, often by questionnaire, evidence review or site visit, repeated on a schedule |
| Compliance attestation | A formal statement that the vendor meets a standard, such as a SOC 2 report or a PCI DSS Attestation of Compliance |
| Penetration testing | An authorized test of the vendor's systems, done only with written permission |
A System and Organization Controls (SOC) 2 Type I report covers whether controls are suitably designed at one point in time. A Type II report also tests how they operated over a period, so it is stronger evidence.
Limitations and constraints
Assessing every vendor fully is rarely possible.
| Constraint | Effect |
|---|---|
| Staffing limitations | Too few people to assess every vendor in depth |
| Resource availability | Limited time, tools or budget for assessments |
| Environment | The vendor's setup, such as a shared cloud platform, may not allow direct testing |
| Legal and regulatory factors | Laws can limit what may be tested or which data may be shared |
| Geography or jurisdiction | A vendor in another country brings different laws and makes audits harder |
| Financial or return on investment (ROI) | The cost of assessing must be worth the risk reduction |
| Vendor lock-in | Dependence on one vendor reduces bargaining power and makes leaving hard |
| Assurance mechanisms | Relying on reports and certifications instead of direct checks gives less certainty |
Because of these limits, vendors are usually tiered by risk. Critical vendors with sensitive data get deep assessments, and low risk vendors get a lighter review.
Rules of engagement
When testing a vendor is allowed, the rules of engagement set what may be tested, when, by whom and by what methods, and who to call if something breaks. They protect both parties from damage and legal trouble.
How the exam asks about this
- "The company needs prices for 500 identical laptops." -> A request for quote (RFQ).
- "The contract lets the customer inspect the provider's data center controls." -> A right to audit clause.
- "The vendor reports 99.5 percent uptime against a target of 99.9 percent." -> A missed SLO, found by service-level monitoring.
What to remember for the exam
- An RFI gathers information, an RFP asks for a detailed proposal and an RFQ asks for a price.
- Due diligence means researching a vendor before signing.
- An MSA sets general terms, and each SOW describes a specific job.
- An SLA sets service levels, and an SLO is a measurable target within it.
- An MOU is less formal than an MOA. An NDA protects confidential information.
- A vendor registry lists every vendor and its risk level.
- A SOC 2 Type II report tests controls over a period of time.
- Constraints such as staffing, jurisdiction and lock-in limit how deeply vendors can be checked.
If a question asks for a document that lists the scope, deliverables and schedule for one project, choose a statement of work.
Common mistakes
Trusting a questionnaire alone. It is the vendor's own claim, so ask for independent evidence.
Confusing SLA and SLO. The SLA is the agreement, and the SLO is the specific target.
Mixing up MOU and MOA. The MOA is more formal and detailed.
Checking only at the start. Vendors change, so reassess them regularly.
Testing a vendor without permission. Testing systems you do not own without written approval can be illegal.
Check yourself
What does a right to audit clause allow?
It lets the customer, or an auditor acting for it, inspect the vendor's controls.
What is the difference between an SLA and an SLO?
The SLA is the agreement on service levels, and an SLO is one measurable target within it.
Which request asks vendors for a detailed proposal to meet stated requirements?
A request for proposal (RFP).
Topic 4 of 7 in Security Program Management and Oversight
Test yourself on Security Program Management and Oversight
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.