Lesson 25 - Explain the Processes Associated with Third-Party Risk Assessment and Management

Third Party Risk Management

sum of activities used to conduct due diligence on and evaluate third-parties (e.g. vendors, contractors, business partners)

Fouth-parties

subservice organizations of third-parties

Third-party oversight

implementation of strategies to manage uncertainty, indentify vulnerabilities, and ensure compliance and continuity

Right to Audit

contract clause that allows the contract holder to conduct an audit of the service providers

NDA

protects information from disclosure during and post relationship

MOU (Memorandum of Understanding)

non-binding document that outlines intentions between parties

MOA (Memorandum of Agreement)

legally enforcible document that establishes a contractual relationship between parties

BPA (Business Partner Agreement)

comprehensive legal document that outlines terms and conditions of a relationship between business parties

SLA (Service Level Agreement)

- specifies service and support commitment

- may include incentives/penalties

MSA (master service agreement)

outlines general terms and conditions.

serves as a framework for future agreements/projects between parties

SOW (Statement of Work)

- defines tasks, deliverables, timelines and expectations for a particular project between client and service provider

- falls under the umbrella of an MSA

WO (Work Order)

used to document individual service requests