ServiceNow CIS - Third-Party Risk Management: key terms

Flashcards for this exam ServiceNow CIS - Third-Party Risk Management guide Class dates

• Attestation (IRM)Questionnaire sent to control owners to confirm a control's operation and status.Intermediate
• Attestation of Compliance (AOC)Formal declaration of an entity's PCI DSS compliance status, accompanying a ROC or SAQ.Intermediate
• Audit OpinionAuditor's conclusion on the subject matter: unmodified, qualified, adverse, or disclaimer.Intermediate
• Bridge LetterLetter from a service organization covering the gap between the end of its SOC report period and a later date.Advanced
• Business AssociatePerson or organization that performs functions involving PHI on behalf of a HIPAA covered entity.Intermediate
• Business Associate Agreement (BAA)Contract required by HIPAA between a covered entity and business associate defining permitted uses and safeguards for PHI.Intermediate
• Complementary User Entity Controls (CUEC)Controls a service organization assumes its customers will implement for the overall control objectives to be met.Intermediate
• Concentration RiskRisk from heavy dependence on a single vendor, provider, region, or technology whose failure would have outsized impact.Advanced
• Consensus Assessments Initiative Questionnaire (CAIQ)CSA questionnaire of yes/no questions based on the Cloud Controls Matrix for assessing cloud providers.Intermediate
• Cybersecurity Supply Chain Risk Management (C-SCRM)Practices to identify, assess, and mitigate cybersecurity risks throughout the supply chain of products and services.Intermediate
• Data Processing Agreement (DPA)Contract between a controller and processor setting out GDPR Article 28 obligations.Intermediate
• Digital Operational Resilience Act (DORA)EU Regulation (2022/2554), applicable from 17 January 2025, on ICT risk management for financial entities.Advanced
• Due DiligenceInvestigation and analysis performed to understand risks before and while making decisions.Foundational
• Entity (IRM)Item in scope for risk and compliance, such as a business unit, application, vendor or CI, organized by entity types and classes.Advanced
• External Service Provider (ESP)CMMC term for an external organization providing IT or cybersecurity services that handle CUI or Security Protection Data.Advanced
• Fourth-Party RiskRisk arising from a vendor's own vendors and subcontractors that support services provided to you.Intermediate
• HITRUST CSFCertifiable security and privacy framework harmonizing HIPAA, NIST, ISO, PCI, and other requirements, widely used in healthcare.Intermediate
• Integrated Risk Management (IRM)Set of practices and technology that integrate risk management across business, IT, and compliance functions.Intermediate
• Operating EffectivenessWhether a control operated consistently as designed throughout a specified period.Intermediate
• Right to Audit ClauseContract provision allowing a customer or regulator to audit a vendor's controls, records, and facilities.Intermediate
• Security QuestionnaireStandardized set of questions used to assess a third party's security and privacy controls.Intermediate
• ServiceNow Integrated Risk Management (IRM)ServiceNow GRC suite for managing policies, compliance, risk, audit, vendor risk and business continuity on the Now Platform.Foundational
• ServiceNow Third-Party Risk Management (TPRM)ServiceNow application for assessing and monitoring vendor risk through tiering, questionnaires, documents and issues.Intermediate
• Shared Responsibility ModelFramework dividing security and operational duties between the cloud provider (of the cloud) and customer (in the cloud).Foundational
• SOC 1Report on a service organization's controls relevant to user entities' internal control over financial reporting.Intermediate
• SOC 2Report on a service organization's controls relevant to security, availability, processing integrity, confidentiality, or privacy.Foundational
• SOC Type 1 ReportSOC report on the fairness of the description and suitability of control design as of a specific date.Foundational
• SOC Type 2 ReportSOC report covering both design and operating effectiveness of controls over a specified period.Foundational
• Standard Contractual Clauses (SCC)European Commission-approved contract clauses providing safeguards for transfers of personal data outside the EU.Intermediate
• Sub-ProcessorProcessor engaged by another processor to carry out processing on behalf of a controller.Intermediate
• Subservice OrganizationVendor used by a service organization whose controls may be relevant to the service organization's customers.Advanced
• System and Organization Controls Report (SOC report)AICPA attestation report by a CPA on controls at a service organization.Foundational
• Third-Party Risk Management (TPRM)Discipline of identifying, assessing, mitigating, and monitoring risks from vendors, suppliers, and other external parties.Foundational
• Trust Services Criteria (TSC)AICPA criteria for security, availability, processing integrity, confidentiality, and privacy used in SOC 2 and SOC 3.Intermediate
• Vendor Due DiligencePre-contract evaluation of a vendor's security, privacy, financial, operational, and compliance posture.Intermediate
• Vendor Risk AssessmentQuestionnaire-based evaluation of a third party's controls, sent through the vendor portal.Intermediate