Vendor Management, Privacy, Attestation, and Assessments

Introduction

This lesson continues Domain 5, Security Program Management and Oversight (20% of SY0-701). It covers objective 5.3, explaining the processes associated with third-party risk assessment and management; objective 5.4, summarizing elements of effective security compliance; and objective 5.5, explaining types and purposes of audits and assessments. In the previous lesson you learned how an organization governs itself and treats its own risk. Now the focus moves outward and forward in time: the vendors whose failures become your incidents, the laws and contracts that define what "compliant" means, and the independent checks that prove, or disprove, that your controls work.