Third-party risk and compliance
Domain 5: Security Program Management & Oversight · Not started
Main exam topics
Governance, policies, standards and roles; risk assessment and treatment; vendor oversight; compliance and privacy; audits and assessments; security awareness; annualized loss expectancy = single loss expectancy × annual rate of occurrence.
SY0-701 topic overview · Independent study resource, not a prediction of exam questions.
Assessing vendors
Vendors extend your attack surface. Before onboarding, perform due diligence: questionnaires, review of independent audit reports such as SOC 2 Type II, penetration test summaries, and financial stability checks. Right-to-audit clauses let you verify controls. Monitor vendors continuously, not just at signing, and watch for supply chain risks in software and hardware.
Agreements
A service level agreement defines measurable performance such as uptime. A memorandum of understanding records intent without strong legal obligation. A master service agreement sets overall terms for future work orders. A non-disclosure agreement protects confidential information. A business partners agreement defines responsibilities between partners. Data processing agreements govern personal data handling.
Compliance
Regulations and frameworks set requirements: GDPR for EU personal data, HIPAA for US health information, PCI DSS for card data. Non-compliance can bring fines, sanctions, and loss of license. Internal and external audits verify compliance, and attestation is a formal statement that controls are in place.
Privacy
Data subjects have rights over their personal data, including access and, under GDPR, erasure. Data retention policies define how long data is kept; keeping data longer than needed increases risk.
Know the difference: Common agreements
| Agreement | Purpose | Binding? |
|---|---|---|
| SLA | Performance targets | Yes |
| MOU | Shared intent | Usually not strongly |
| NDA | Confidentiality | Yes |
Saved