1
00:00:06,510 --> 00:00:09,450
- Welcome to lesson 25, deep dive quiz.

2
00:00:09,450 --> 00:00:12,600
Now, lesson 25 was all about
explaining the processes

3
00:00:12,600 --> 00:00:15,900
associated with third-party
risk assessment and management.

4
00:00:15,900 --> 00:00:18,840
And we only had one lesson, 25.1,

5
00:00:18,840 --> 00:00:21,240
which was third-party risk management.

6
00:00:21,240 --> 00:00:25,020
So now together, we're gonna
do a five-question quiz.

7
00:00:25,020 --> 00:00:26,310
You know how to do this.

8
00:00:26,310 --> 00:00:28,350
Let's make sure you
have a pen or a pencil,

9
00:00:28,350 --> 00:00:29,490
a piece of paper.

10
00:00:29,490 --> 00:00:32,160
Put me on pause as often as you need to,

11
00:00:32,160 --> 00:00:35,010
so that you can dive right in
and answer these questions.

12
00:00:35,010 --> 00:00:36,243
Are you ready? Let's go.

13
00:00:38,610 --> 00:00:41,880
Your organization is moving
its data center to the cloud.

14
00:00:41,880 --> 00:00:43,890
Uptime is critical.

15
00:00:43,890 --> 00:00:45,270
What type of agreement is used

16
00:00:45,270 --> 00:00:49,500
to codify service
requirements and consequences?

17
00:00:49,500 --> 00:00:54,367
A BAA, an AUP, an SLA, or an MOU.

18
00:00:56,130 --> 00:00:58,590
Again, you may get acronyms,
right, in your exam,

19
00:00:58,590 --> 00:01:00,390
so be ready for that.

20
00:01:00,390 --> 00:01:05,390
A BAA, an AUP, an SLA, or an MOU.

21
00:01:09,120 --> 00:01:11,040
What are you gonna choose?

22
00:01:11,040 --> 00:01:13,020
I'm gonna go right for our SLA

23
00:01:13,020 --> 00:01:15,690
that stands for service-level
agreement, right?

24
00:01:15,690 --> 00:01:17,280
That's gonna be the type of agreement

25
00:01:17,280 --> 00:01:21,120
that will codify our service
requirements and consequences,

26
00:01:21,120 --> 00:01:23,223
which could be rewards or penalties.

27
00:01:24,540 --> 00:01:27,930
Let's check, and that is correct.

28
00:01:27,930 --> 00:01:31,380
Question two, which group would not,

29
00:01:31,380 --> 00:01:33,480
not being the important word here,

30
00:01:33,480 --> 00:01:36,090
not be considered a third party?

31
00:01:36,090 --> 00:01:38,910
An MSPs, work-from-home employees,

32
00:01:38,910 --> 00:01:42,390
consultants, or contractors.

33
00:01:42,390 --> 00:01:44,160
This is a great example
of what would happen

34
00:01:44,160 --> 00:01:46,500
if you read a question too fast

35
00:01:46,500 --> 00:01:48,420
and then answered the first, you know,

36
00:01:48,420 --> 00:01:50,700
chose the first answer that you liked.

37
00:01:50,700 --> 00:01:51,533
Because if you read it

38
00:01:51,533 --> 00:01:54,660
as which group would be
considered a third party

39
00:01:54,660 --> 00:01:55,830
and you got to MSPs,

40
00:01:55,830 --> 00:01:57,420
you might say, "Oh, yeah,
there you go, done."

41
00:01:57,420 --> 00:01:59,070
Moving on to the next.

42
00:01:59,070 --> 00:02:00,900
So make sure of two things, right?

43
00:02:00,900 --> 00:02:02,970
You're reading carefully for comprehension

44
00:02:02,970 --> 00:02:05,880
and that you read every answer option.

45
00:02:05,880 --> 00:02:09,090
So which group would not be
considered a third party?

46
00:02:09,090 --> 00:02:12,060
Well, MSPs, definitely a third party,

47
00:02:12,060 --> 00:02:14,040
consultants, they're a third party,

48
00:02:14,040 --> 00:02:16,260
contractors, they're a third party, right?

49
00:02:16,260 --> 00:02:20,190
None of them are
considered your employees.

50
00:02:20,190 --> 00:02:22,680
How about our work-from-home employees?

51
00:02:22,680 --> 00:02:25,230
They would not be
considered a third party.

52
00:02:25,230 --> 00:02:27,210
Agree? Let's check.

53
00:02:27,210 --> 00:02:28,043
There you go.

54
00:02:28,890 --> 00:02:31,410
Your organization is
negotiating a contract

55
00:02:31,410 --> 00:02:32,550
with a new vendor.

56
00:02:32,550 --> 00:02:33,510
A sticking point

57
00:02:33,510 --> 00:02:37,350
is that they refuse to include
a right to audit clause.

58
00:02:37,350 --> 00:02:40,620
What might be an acceptable alternative?

59
00:02:40,620 --> 00:02:42,183
Choose all that apply.

60
00:02:43,080 --> 00:02:45,660
So what might you accept?

61
00:02:45,660 --> 00:02:50,130
An internal security report,
an industry certification,

62
00:02:50,130 --> 00:02:53,250
so perhaps you've been certified by ISO

63
00:02:53,250 --> 00:02:56,430
or another industry certification
for the organization,

64
00:02:56,430 --> 00:02:58,683
maybe PCI DSS certification,

65
00:02:59,790 --> 00:03:03,030
an SSAE 18 audit report,

66
00:03:03,030 --> 00:03:05,970
or an independent, meaning a third party,

67
00:03:05,970 --> 00:03:07,233
security assessment?

68
00:03:09,300 --> 00:03:10,503
What might you accept?

69
00:03:13,200 --> 00:03:15,480
And not allowing you to come in and audit,

70
00:03:15,480 --> 00:03:17,793
but what would you accept in lieu of that?

71
00:03:19,050 --> 00:03:20,700
Well, here's what we
probably wouldn't accept,

72
00:03:20,700 --> 00:03:22,383
an internal security report.

73
00:03:23,250 --> 00:03:25,320
Industry certification, we might, right,

74
00:03:25,320 --> 00:03:27,210
depending on how robust it is.

75
00:03:27,210 --> 00:03:31,050
An SSAE 18 audit report, probably,

76
00:03:31,050 --> 00:03:33,000
and an independent security assessment

77
00:03:33,000 --> 00:03:36,483
done by a reputable firm, we'd
probably accept that as well.

78
00:03:37,380 --> 00:03:41,790
What we wouldn't accept is
their internal security report.

79
00:03:41,790 --> 00:03:43,170
Do you agree?

80
00:03:43,170 --> 00:03:44,910
Okay, let's check.

81
00:03:44,910 --> 00:03:46,083
And that is correct.

82
00:03:50,100 --> 00:03:52,050
All right, we're gonna match the agreement

83
00:03:52,050 --> 00:03:54,210
and the description,

84
00:03:54,210 --> 00:03:59,210
and our agreements are an MSA,
an MOA, an MOU, or an NDA.

85
00:04:01,500 --> 00:04:03,720
A master services agreement,

86
00:04:03,720 --> 00:04:05,520
a memorandum of agreement,

87
00:04:05,520 --> 00:04:09,690
a memorandum of understanding, or an NDA.

88
00:04:09,690 --> 00:04:10,590
On the right hand side,

89
00:04:10,590 --> 00:04:13,050
we have a framework for future projects,

90
00:04:13,050 --> 00:04:15,750
non-binding outline agreement,

91
00:04:15,750 --> 00:04:19,170
establishes data ownership and control,

92
00:04:19,170 --> 00:04:21,300
or a legally enforceable agreement

93
00:04:21,300 --> 00:04:23,520
that establishes a relationship.

94
00:04:23,520 --> 00:04:26,073
Go ahead and put me on
pause and match these up.

95
00:04:29,040 --> 00:04:30,810
All right, well, let's
start right up on top.

96
00:04:30,810 --> 00:04:33,540
A framework for future projects.

97
00:04:33,540 --> 00:04:34,680
Oh, it's right there.

98
00:04:34,680 --> 00:04:37,330
That's probably gonna be a
master services agreement.

99
00:04:38,430 --> 00:04:40,500
A non-binding outline agreement,

100
00:04:40,500 --> 00:04:42,150
an agreement sort of outlines

101
00:04:42,150 --> 00:04:43,950
what the relationship is gonna be,

102
00:04:43,950 --> 00:04:47,610
but the key is it is non-binding.

103
00:04:47,610 --> 00:04:51,750
That's gonna be an MOU, a
memorandum of understanding.

104
00:04:51,750 --> 00:04:54,693
We have an understanding,
but it's not legally binding.

105
00:04:55,950 --> 00:04:58,320
Establishes data control and ownership.

106
00:04:58,320 --> 00:04:59,490
Oh, we're gonna come right down here

107
00:04:59,490 --> 00:05:02,130
to our NDA, our non-disclosure agreement,

108
00:05:02,130 --> 00:05:07,050
and that leaves for MOA,
memorandum of agreement,

109
00:05:07,050 --> 00:05:09,240
our legally enforceable agreement

110
00:05:09,240 --> 00:05:11,700
that establishes a relationship.

111
00:05:11,700 --> 00:05:13,110
So let's review these.

112
00:05:13,110 --> 00:05:16,290
An MSA, a framework for future projects.

113
00:05:16,290 --> 00:05:19,020
An MOA, a legally enforceable agreement

114
00:05:19,020 --> 00:05:20,970
that establishes a relationship.

115
00:05:20,970 --> 00:05:24,750
An MOU, a non-binding outline agreement,

116
00:05:24,750 --> 00:05:28,860
and an NDA, which establishes
data ownership control.

117
00:05:28,860 --> 00:05:29,820
Agree?

118
00:05:29,820 --> 00:05:33,450
All right, let's check
and that is perfect.

119
00:05:33,450 --> 00:05:34,293
Good work.

120
00:05:35,640 --> 00:05:38,520
All right, we are going to
choose the correct answer

121
00:05:38,520 --> 00:05:40,800
in the dropdown box,

122
00:05:40,800 --> 00:05:43,413
and these are going to be true or false.

123
00:05:45,420 --> 00:05:47,850
Compliance responsibility
can be outsourced

124
00:05:47,850 --> 00:05:49,680
to third parties.

125
00:05:49,680 --> 00:05:52,080
Incident management
protocols should be included

126
00:05:52,080 --> 00:05:54,570
in third-party contracts.

127
00:05:54,570 --> 00:05:57,030
Fourth-parties are
subservice organizations

128
00:05:57,030 --> 00:05:58,440
of third parties,

129
00:05:58,440 --> 00:06:00,360
or due diligence should be limited

130
00:06:00,360 --> 00:06:02,253
to the initial investigation.

131
00:06:04,560 --> 00:06:05,670
So the first one's interesting.

132
00:06:05,670 --> 00:06:10,170
Compliance responsibility,
not compliance actions,

133
00:06:10,170 --> 00:06:13,080
but responsibility for
compliance can be outsourced

134
00:06:13,080 --> 00:06:14,073
to a third party.

135
00:06:15,060 --> 00:06:16,710
What do you think? True or false?

136
00:06:18,660 --> 00:06:22,140
That's gonna be absolutely false, right?

137
00:06:22,140 --> 00:06:26,670
We can require, right, that
our third parties comply

138
00:06:26,670 --> 00:06:29,130
with all of our compliance requirements,

139
00:06:29,130 --> 00:06:32,430
but ultimately, the
responsibility for compliance

140
00:06:32,430 --> 00:06:33,900
can't be outsourced.

141
00:06:33,900 --> 00:06:35,520
The responsibility for compliance

142
00:06:35,520 --> 00:06:39,360
will still be maintained
by the organization.

143
00:06:39,360 --> 00:06:42,127
You can never say to your oversight body,

144
00:06:42,127 --> 00:06:43,740
"Oh, well, it wasn't
us, it was my vendor."

145
00:06:43,740 --> 00:06:44,573
They're gonna say,

146
00:06:44,573 --> 00:06:47,580
"Yeah, but you are
responsible for your vendor.

147
00:06:47,580 --> 00:06:49,860
You have the compliance responsibility."

148
00:06:49,860 --> 00:06:52,500
So we're gonna say false on that one.

149
00:06:52,500 --> 00:06:54,000
All right. How about the next one?

150
00:06:54,000 --> 00:06:56,460
Incident management
protocols should be included

151
00:06:56,460 --> 00:06:58,293
in third-party contracts.

152
00:06:59,220 --> 00:07:01,440
Do you wanna put that in your contract?

153
00:07:01,440 --> 00:07:03,030
True or false?

154
00:07:03,030 --> 00:07:04,170
Ah, I really like that one.

155
00:07:04,170 --> 00:07:06,052
Absolutely true.

156
00:07:06,052 --> 00:07:09,060
All right, we really wanna
say this is how incidents

157
00:07:09,060 --> 00:07:09,893
are gonna be handled.

158
00:07:09,893 --> 00:07:11,910
This is how quickly we wanna be notified.

159
00:07:11,910 --> 00:07:13,530
This is who you're gonna notify,

160
00:07:13,530 --> 00:07:15,980
and this is the protocol
that we're gonna follow.

161
00:07:17,160 --> 00:07:17,993
All right, next one.

162
00:07:17,993 --> 00:07:20,160
Fourth parties are
subservice organizations

163
00:07:20,160 --> 00:07:20,993
of a third party.

164
00:07:20,993 --> 00:07:22,173
Is that true or false?

165
00:07:23,615 --> 00:07:25,770
Well, that's definitely true, right?

166
00:07:25,770 --> 00:07:27,963
That is our definition of a fourth party.

167
00:07:29,040 --> 00:07:31,860
All right, lastly, due
diligence should be limited

168
00:07:31,860 --> 00:07:33,630
to the initial investigation.

169
00:07:33,630 --> 00:07:35,160
What do you think?

170
00:07:35,160 --> 00:07:36,840
Well, we do wanna do due diligence

171
00:07:36,840 --> 00:07:38,643
during the initial investigation,

172
00:07:39,480 --> 00:07:42,300
but do we wanna do due
diligence other times?

173
00:07:42,300 --> 00:07:43,133
Absolutely.

174
00:07:43,133 --> 00:07:44,760
How about during the
life of the relationship

175
00:07:44,760 --> 00:07:48,330
and especially whenever there's
a new contract to be signed?

176
00:07:48,330 --> 00:07:49,833
So true or false?

177
00:07:50,700 --> 00:07:52,650
That is gonna be false.

178
00:07:52,650 --> 00:07:53,940
So we have false.

179
00:07:53,940 --> 00:07:56,024
We have compliance
responsibility can be outsourced

180
00:07:56,024 --> 00:07:58,440
to third parties, false.

181
00:07:58,440 --> 00:08:00,360
Incident management
protocols should be included

182
00:08:00,360 --> 00:08:02,850
in third-party contracts, true.

183
00:08:02,850 --> 00:08:05,730
Fourth parties are
subservice organizations

184
00:08:05,730 --> 00:08:08,160
of third parties, true.

185
00:08:08,160 --> 00:08:09,750
And due diligence should be limited

186
00:08:09,750 --> 00:08:12,360
to the initial investigation, false.

187
00:08:12,360 --> 00:08:13,410
Do you agree?

188
00:08:13,410 --> 00:08:16,260
Okay, let's check and we are correct.

189
00:08:16,260 --> 00:08:18,120
Awesome. Another great job.

190
00:08:18,120 --> 00:08:19,260
You guys are cool.

191
00:08:19,260 --> 00:08:21,630
All right, next up, lesson 26,

192
00:08:21,630 --> 00:08:26,130
summarize the elements of
effective security compliance.

193
00:08:26,130 --> 00:08:27,080
I'll see you there.