Shared Assessments Third Party Risk Management CTPRP Question # 26 Topic 3 Discussion
CTPRP Exam Topic 3 Question 26 Discussion:
Question #: 26
Topic #: 3
When defining due diligence requirements for the set of vendors that host web applications which of the following is typically NOT part of evaluating the vendor's patch
management controls?
A.
The capability of the vendor to apply priority patching of high-risk systems
B.
Established procedures for testing of patches, service packs, and hot fixes prior to installation
C.
A documented process to gain approvals for use of open source applications
D.
The existence of a formal process for evaluation and prioritization of known vulnerabilities
A documented process to gain approvals for use of open source applications is typically not part of evaluating the vendor’s patch management controls, because it is not directly related to the patching process. Patch management controls are the policies, procedures, and tools that enable an organization to identify, acquire, install, and verify patches for software vulnerabilities. Patch management controls aim to reduce the risk of exploitation of known software flaws and ensure the functionality and compatibility of the patched systems. A documented process to gain approvals for use of open source applications is more relevant to the software development and procurement processes, as it involves assessing the legal, security, and operational implications of using open source software components in the vendor’s products or services. Open source software may have different licensing terms, quality standards, and support levels than proprietary software, and may introduce additional vulnerabilities or dependencies that need to be managed. Therefore, a documented process to gain approvals for use of open source applications is a good practice for vendors, but it is not a patch management control per se. References:
Guide to Enterprise Patch Management Planning
Governance of Key Aspects of System Patch Management
Certified Third Party Risk Professional (CTPRP) Study Guide
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit