Third Party Risk Management Changed CTPRP Questions

According to the Shared Assessments Certified Third Party Risk Professional (CTPRP) Study Guide, physical security compliance is the process of ensuring that the physical assets and personnel of an organization are protected from unauthorized access, theft, damage, or harm1. Physical security compliance can be achieved by implementing various measures, such as locks, alarms, cameras, guards, fences, badges, etc. However, these measures need to be regularly monitored, tested, and verified to ensure their effectiveness and alignment with the defined standards and policies2. Therefore, maintaining a standardized schedule for confirming controls to defined standards demonstrates a greater maturity of physical security compliance, as it indicates a proactive and consistent approach to assessing and improving the physical security posture of an organization3.

The other options do not reflect a high level of physical security compliance maturity, as they either rely on reactive or ad hoc methods, or lack sufficient verification and validation mechanisms. Leveraging periodic reporting to schedule facility inspections based on reported events may indicate a lack of preventive and predictive measures, as well as a dependency on external or internal incidents to trigger the inspections. Providing a checklist for self-assessment may indicate a lack of independent and objective evaluation, as well as a potential for bias or error in the self-assessment process. Conducting unannounced checks on an ad hoc basis may indicate a lack of planning and coordination, as well as a potential for disruption or inconsistency in the checks.

References:

• 1: Shared Assessments Certified Third Party Risk Professional (CTPRP) Study Guide, page 24
• 2: Physical Security: Planning, Measures & Examples + PDF - Avigilon
• 3: Security Maturity Models: Levels, Assessment, and Benefits
• [4]: Best Practices for Planning and Managing Physical Security Resources - CISA, page 10
• [5]: Self-Assessment vs. Independent Assessment: What’s the Difference? | Linford & Company LLP
• [6]: The Pros and Cons of Unannounced Audits | NQA

 Criticality is a measure of how essential a service provider is to the organization’s core business functions and objectives. It reflects the potential consequences of a service disruption or failure on the organization’s operations, reputation, compliance, and financial performance. Criticality is not the same as risk, which is the likelihood and severity of a negative event occurring. Criticality helps to prioritize the risk assessment and mitigation efforts for different service providers based on their relative importance to the organization. Criticality is not limited to a specific type of service, such as disaster recovery or personal information, nor is it determined by the mode of access or connectivity. Criticality is assigned to the service providers that have the greatest impact on the organization’s ability to deliver its products or services to its customers and stakeholders in a timely and satisfactory manner. References:

• Shared Assessments. (2020). Certified Third Party Risk Professional (CTPRP) Study Guide1
• Milliman. (2017). Defining “critical or important functions or activities” for outsourcing purposes2
• Webster, C. and Sundaram, D.S. (2009). Effect of service provider’s communication style on customer satisfaction in professional services setting: the moderating role of criticality and service nature. Journal of Services Marketing, 23(2), 103-1131