Examkin

Question

Difficulty: MediumThird-Party Risk Management and Supply Chain Oversight

A logistics firm plans to contract a third-party software vendor to manage its real-time route optimization platform. Prior to completing vendor onboarding, the security manager requires verifiable proof that the vendor's security controls have operated effectively throughout a sustained six-month evaluation period. Which of the following third-party documentation types best fulfills this requirement?

  1. SOC 2 Type II reportAnswer
  2. B
    SOC 2 Type I report
  3. C
    Vendor Security Assessment Questionnaire (VSAQ)
  4. D
    Service Level Agreement (SLA) performance log

Answer

SOC 2 Type II report
A System and Organization Controls (SOC) 2 Type II report provides independent third-party auditor verification regarding both the design and operational effectiveness of security controls over a designated testing period (typically 6 to 12 months). This directly aligns with the requirement for proof of sustained control operating performance.

Step-by-Step Solution

1
Identify the key third-party security assurance requirement in the scenario
The scenario calls for evidence confirming operating effectiveness of controls over a continuous six-month timeframe.
Assessing vendor risk requires distinguishing between point-in-time compliance attestations and continuous operational effectiveness.
2
Compare third-party assessment artifacts against the required monitoring duration
A SOC 2 Type II audit specifically involves auditor testing of security controls across an extended period (typically 6-12 months), fulfilling the requirement.
Point-in-time audits (Type I), self-assessments (VSAQ), and availability metrics (SLA logs) do not test sustained security control performance.

Key Concept

Third-Party Risk Assessment Artifacts and SOC Reporting
Rate this question

Topics

Third-Party Risk Management and Supply Chain Oversight

More questions from this topic