Security+ topic 5.3
Third-Party Risk and Procurement
Vendors and suppliers can bring risk into an organization, as supply chain attacks have shown. Before buying, organizations assess vendors with questionnaires, due diligence, and the right-to-audit clause. SY0-801 adds procurement vocabulary for evaluating vendors and products. Agreements set expectations: a service-level agreement (SLA) defines performance, a memorandum of understanding (MOU) and memorandum of agreement (MOA) describe how parties will work together, a master service agreement (MSA) sets general terms, a statement of work (SOW) defines a specific job, and a non-disclosure agreement (NDA) protects confidential information. Vendors are monitored for as long as the relationship lasts.
Third-Party Risk and Procurement vocabulary
- Supply chain attack: Compromising a target by attacking a vendor, product, or update it relies on.
- Service-level agreement (SLA): A contract that defines the level of service a vendor must provide, such as uptime.
- Right-to-audit clause: A contract term that lets a customer audit the vendor's security.
- Non-disclosure agreement (NDA): A contract that requires parties to keep shared information confidential.
Exam-style practice questions
Try each one, then open the answer. To save your progress, take this quiz in the interactive course.
1. Attackers break into a software vendor and add malware to an update that thousands of customers install. Which of the following attacks is this?
- (A) Supply chain attack
- (B) Watering hole attack
- (C) On-path attack
- (D) Brute force attack
Show answer
(A) Supply chain attack Compromising a vendor's product to reach its customers is a supply chain attack.
2. A contract states that a cloud provider must keep its service available 99.9% of the time. Which of the following agreements is this?
- (A) NDA
- (B) SLA
- (C) MOU
- (D) AUP
Show answer
(B) SLA A service-level agreement defines performance such as uptime.
3. A company wants the contractual ability to inspect a vendor's security controls. Which of the following should be in the contract?
- (A) A right-to-audit clause
- (B) A non-compete clause
- (C) A force majeure clause
- (D) An acceptable use policy
Show answer
(A) A right-to-audit clause A right-to-audit clause allows security audits of the vendor.
4. Before signing with a new payroll vendor, a company sends a security questionnaire and reviews the vendor's audit reports. Which of the following is this?
- (A) Due diligence
- (B) Eradication
- (C) Tokenization
- (D) Threat hunting
Show answer
(A) Due diligence Researching a vendor's security before buying is due diligence.