CompTIA Security+ SY0-701 Cert Guide

Chapter 25

Understanding the Processes Associated with Third-Party Risk Assessment and Management

This chapter covers the following topics related to Objective 5.3 (Explain the processes associated with third-party risk assessment and management) of the CompTIA Security+ SY0-701 certification exam:

• Vendor assessment

• Vendor selection

• Agreement types

• Vendor monitoring

• Questionnaires

• Rules of engagement

This chapter is a comprehensive guide to third-party risk management, focusing on vendor assessment, selection, and ongoing monitoring. It emphasizes the importance of well-defined service-level agreements (SLAs) and covers various assessment methods, such as penetration testing and the right-to-audit clause. The chapter also delves into internal ...