SY0-701 · Objective 5.3 · Security Program Management and Oversight
5.3 Third-party risk explained
The official objective: “Explain the processes associated with third-party risk assessment and management.” Here is what it means, what candidates mix up, and 3 practice questions that test it.
What objective 5.3 covers
Every vendor you rely on becomes part of your attack surface. Objective 5.3 covers how to assess a vendor before you sign, how to write the relationship into agreements, and how to keep watching it afterwards.
Vendor assessment uses several tools. You can ask for, or commission, a penetration test of the vendor's systems. A right-to-audit clause in the contract lets you inspect the vendor's controls during the relationship. Evidence of internal audits and independent assessments, such as a SOC 2 Type II report, shows how controls have performed over time. Supply chain analysis looks at the vendor's own suppliers and where components come from.
Vendor selection adds due diligence, which checks a vendor's financial health, security posture, certifications, breach history and references before you commit, and a check for conflicts of interest, such as a manager who owns shares in a bidding company.
Agreement types are tested mostly by definition. A service-level agreement (SLA) sets measurable service levels, such as uptime and response times, and the remedies if they are missed. A memorandum of understanding (MOU) records a shared, usually non-binding intent to cooperate. A memorandum of agreement (MOA) is more formal and records agreed responsibilities, but still isn't a full commercial contract. A master service agreement (MSA) sets the general legal terms for an ongoing relationship. A work order or statement of work (WO/SOW) then defines a specific project under that MSA: deliverables, timeline and price. A non-disclosure agreement (NDA) protects confidential information. A business partners agreement (BPA) covers a long-term partnership, such as a joint venture, including each party's responsibilities and how profits are shared.
Management continues after signing. Vendor monitoring reviews security reports, certifications and news of breaches on a regular schedule. Questionnaires ask detailed, structured questions about the vendor's controls. Rules of engagement define what a security test may and may not do, the systems in scope, timing and contacts.
Exam questions usually ask for the best tool for a stated need. Want to inspect controls yourself later: right to audit. Want proof controls worked over a period: an independent assessment report. Need to define one project under an existing contract: a SOW. Need ongoing assurance after onboarding: vendor monitoring.
What candidates mix up
- MSA versus SOW: the MSA sets general terms once; each SOW defines a specific project under it.
- MOU versus MOA: an MOU expresses intent; an MOA records agreed responsibilities more formally.
- SLA versus MOU: an SLA has measurable, enforceable service levels; an MOU usually doesn't.
- Due diligence versus vendor monitoring: due diligence happens before selection; monitoring happens throughout the relationship.
Practice questions for 5.3
From the CertRidge SY0-701 question bank. Try each one before opening the answer.
Question 1
Before onboarding a supplier that will handle regulated customer data, the security team wants contractual assurance they can inspect the supplier's controls during the relationship. Which clause provides this?
- AA right-to-audit clause
- BA non-disclosure agreement alone
- CA memorandum of understanding
- DA service level agreement's uptime target
Show answer and explanation
Answer: A) A right-to-audit clause
- AA right-to-audit clause grants the customer (or an appointed third party) the contractual ability to review the supplier's security controls, often supplemented by requiring independent assessments like SOC 2.
- BAn NDA governs confidentiality of shared information; it doesn't grant audit rights.
- CAn MOU expresses intent and is generally non-binding; it isn't an audit-rights mechanism.
- DSLA availability metrics say nothing about the customer's ability to audit security controls.
Question 2
Last year, a company completed due diligence on a payroll SaaS provider and signed a contract with it. Which activity BEST represents ongoing third-party risk management for this relationship now?
- AReviewing the provider's latest SOC 2 Type 2 report and annual security questionnaire answers
- BPerforming a conflict-of-interest check on staff involved in choosing the provider
- CNegotiating a right-to-audit clause before signing the initial service agreement
- DDefining security evaluation criteria for the request for proposal (RFP) to bidders
Show answer and explanation
Answer: A) Reviewing the provider's latest SOC 2 Type 2 report and annual security questionnaire answers
Ongoing third-party risk management means monitoring a vendor after onboarding, for example by reviewing current SOC 2 reports and questionnaires. Conflict-of-interest checks, RFP criteria and contract negotiation all happen before onboarding.
- ACorrect. After onboarding, vendor risk is managed through regular monitoring. This includes reviewing current independent audit reports, collecting questionnaires or attestations, and confirming that contractual security obligations are still met.
- BIncorrect. Conflict-of-interest checks belong to vendor selection, before the contract is signed. They do not monitor a vendor that has already been onboarded.
- CIncorrect. Negotiating a right-to-audit clause happens during contracting, before onboarding. Using that right later can support monitoring, but negotiating it is not an ongoing activity.
- DIncorrect. RFP evaluation criteria are set during sourcing and selection, before any supplier is chosen or onboarded.
Question 3
An organization already has a signed contract with a managed service provider that sets the general legal terms, liability, and payment terms for all future work. For a new firewall migration project, the two parties now document the exact scope, deliverables, timeline, and acceptance criteria. Which document are they creating?
- AStatement of work (SOW)
- BMaster service agreement (MSA)
- CService level agreement (SLA)
- DMemorandum of understanding (MOU)
Show answer and explanation
Answer: A) Statement of work (SOW)
A statement of work captures the scope, deliverables, timeline, and acceptance criteria for a specific engagement. It sits under a master service agreement, which holds the general contract terms.
- ACorrect. A SOW defines the scope, deliverables, dates, and acceptance criteria for one specific engagement. It is typically issued under an existing master agreement that already covers the general legal terms.
- BIncorrect. The MSA is the existing contract that sets the general terms for all future work. Project-specific details go into SOWs issued under it.
- CIncorrect. An SLA sets measurable service targets, such as uptime and response times, and remedies if they are missed. It does not define a project's scope or deliverables.
- DIncorrect. An MOU states the general intent to cooperate and is usually not legally binding. It doesn't contain detailed deliverables or acceptance criteria.
Other Security Program Management and Oversight objectives
Also: the Security Program Management and Oversight domain page (20% of the exam), all SY0-701 objectives and the SY0-701 cheat sheet.
Ready for a full SY0-701 practice exam?
Timed practice exams match the real exam's length and domain weights, every result shows your score per domain, and Review Mode re-drills the questions you missed.
Objective numbers and statements from CompTIA's published SY0-701 exam objectives. The explanations and questions are our own. Not affiliated with CompTIA.