5.3 Explain the processes associated with third-party risk assessment and management

★ Starred in your notes: SLA · MSA · BPA · NDA.

Breakdown 1 — Why third parties matter

From class — third-party security concerns: not much control; check their policies. Supply-chain vectors (2.2) and MSP/vendor compromise reach you through the trust you extend.

Breakdown 2 — Vendor assessment (before and during)

Activity	What it is
Penetration testing	Require evidence the vendor tests its own systems (or allow you to)
Right-to-audit clause	Contract term letting you (or your auditor) inspect the vendor's controls
Evidence of internal audits	Vendor shares audit results
Independent assessments	Third-party attestations: SOC 2 Type II, ISO 27001 certificate, PCI AOC
Supply chain analysis	Map the vendor's own vendors — where do their risks come from?
Questionnaires	Standardized security questionnaires (SIG, CAIQ) the vendor completes
Vendor monitoring	Ongoing: re-assess yearly, watch their breaches, review SLA reports, risk-scoring services
Rules of engagement	For any testing you do against the vendor — scope, timing, contacts, what's off-limits

Breakdown 3 — Vendor selection

• Due diligence — do your part before (class): financial stability, security posture, references, certifications, legal history.
• Conflict of interest — the decision-maker (or the vendor) has a competing interest (auditor who also sells the product; employee with equity in the vendor). Disclose and separate.

Breakdown 4 — Agreement types (class: know SLA, MSA, BPA, NDA)

Agreement	Purpose	Binding?	Class note
SLA — service-level agreement	Measurable service targets (uptime 99.999%, response time) and penalties	Yes	"like cloud"
MSA — master service agreement	Umbrella contract with general terms; individual work is added via SOWs	Yes	"master service agreement"
WO / SOW — work order / statement of work	Specific deliverables, timeline, price for one project under the MSA	Yes
NDA — non-disclosure agreement	Protects confidential information shared between parties	Yes
BPA — business partners agreement	Defines a partnership: responsibilities, profit sharing, decision rights	Yes
MOU — memorandum of understanding	Statement of intent/alignment; usually not binding	No (typically)
MOA — memorandum of agreement	More detailed than an MOU; may be binding	Sometimes
ISA — interconnection security agreement	Technical/security terms for connecting two networks	Yes	(class: crossed out — "won't be on it")

Exam tip: "Uptime guarantee with credits" → SLA. "Framework contract, details in later documents" → MSA (+ SOW). "Two companies sharing profits on a joint product" → BPA. "Share a design under confidentiality" → NDA. "Two agencies agree to cooperate, no legal obligations" → MOU. "Contract lets us inspect their data center" → right-to-audit.

Quick self-check

• MSA vs. SOW? (Umbrella terms vs. the specific job.)
• Which agreement is typically non-binding? (MOU.)
• What's the purpose of a right-to-audit clause?