Rule Atlas
NIST SP 800-37: Third-Party, Vendor, and Cloud Service Provider Risk
Under NIST SP 800-37 (ISACA / NIST RMF / ISO 31000), third-Party, Vendor, and Cloud Service Provider Risk establishes the authoritative rules tested on the ISACA CRISC. Master the principles and controls for managing risks associated with external entities, including due diligence, contract management, and continuous monitoring, as per CRISC guidelines. VoraPrep verifies every threshold, worked table, and practice question below against the current ISACA CRISC blueprint.
Core Statutory Concepts
| Feature | SOC 1 Report | SOC 2 Report |
|---|---|---|
| Primary Focus | Internal controls over financial reporting | Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy) |
| Audience | User entities' financial statement auditors | User entity management, regulators, business partners |
| Purpose | Evaluate impact on user entity's financial data | Evaluate controls relevant to data security and operational reliability |
| Applicability | Service organizations impacting client financials | Cloud providers, SaaS, data centers, managed security providers |
An organization is negotiating a Service Level Agreement (SLA) with a new critical cloud-based Enterprise Resource Planning (ERP) provider. The provider's proposed SLA includes a Recovery Time Objective (RTO) of 8 hours and a Recovery Point Objective (RPO) of 4 hours for its service. However, the organization's recent Business Impact Analysis (BIA) for the core business process supported by the ERP system established a Maximum Tolerable Downtime (MTD) of 6 hours. What is the MOST critical action the CRISC practitioner should recommend to the negotiation team before finalizing the contract?
Practitioner Application: Third-Party, Vendor, and Cloud Service Provider Risk
Your company, 'Global Fintech Solutions', is planning to migrate its core financial processing systems to a leading cloud service provider (CSP). This move promises significant cost savings and scalability but introduces complex third-party risks related to data privacy, regulatory compliance, and service availability. As the CRISC-certified risk manager, you must develop a comprehensive strategy for vetting the CSP, negotiating 'Service Level Agreements' (SLAs), establishing ongoing monitoring, and ensuring the inherent risks of outsourcing are effectively managed to protect 'Global Fintech Solutions' and its customers.
- Third-party risk management is a critical component of 'Risk Response and Reporting' (CRISC-3), especially as organizations increasingly rely on external vendors, supply chain partners, and 'Cloud Service Providers' (CSPs). The ISACA Risk IT Framework, COBIT 2019 (specifically APO12 'Managed Risk'), COSO ERM, and NIST SP 800-37 emphasize that while operations may be outsourced, the ultimate accountability for risk remains with the organization engaging the third party.
- Due Diligence: Thoroughly assessing a potential third party's security posture, financial stability, operational capabilities, and compliance with relevant regulations before engaging them. This includes reviewing their policies, procedures, certifications, and past performance. Contractual Agreements: Establishing clear contracts and 'Service Level Agreements' (SLAs) that define responsibilities, performance metrics (e.g., 'RTO', 'RPO'), security requirements, audit rights, incident response obligations, data ownership, and termination clauses. Ongoing Monitoring: Continuously assessing the third party's performance and adherence to contractual obligations and security standards throughout the engagement. This can involve regular audits, performance reviews, and review of their control reports. Exit Strategy: Planning for the termination of the relationship, including data retrieval, secure deletion, and transition to another provider or in-house operations.
Common ISACA CRISC Distractors on NIST SP 800-37
- 1⚠️ Exam trap: Over-reliance on initial due diligence. While crucial, initial due diligence is a snapshot. The exam expects you to understand the necessity of 'continuous monitoring' and periodic reassessments. A vendor's security posture can degrade over time.
- 2Accountability Stays: 'Accountability' for outsourced risks remains with the engaging organization, not the third party.
- 3Lifecycle Approach: Third-party risk management is a continuous process from selection, 'due diligence', contracting ('SLAs'), 'monitoring', to 'offboarding'.
- 4SOC Reports: Understand the distinction: 'SOC 1' (financial reporting), 'SOC 2' (Trust Services Criteria - security, availability, etc.). 'Type 2' reports offer stronger assurance than 'Type 1' due to testing of operating effectiveness over time.
- 5Contractual Terms: 'SLAs' must clearly define performance, security, incident response, and audit rights, aligning with organizational 'RTO' and 'RPO' objectives.
Frequently Asked Questions: NIST SP 800-37
What is the core rule under NIST SP 800-37 (Third-Party, Vendor, and Cloud Service Provider Risk)?
Under NIST SP 800-37 (ISACA / NIST RMF / ISO 31000), third-Party, Vendor, and Cloud Service Provider Risk establishes the authoritative rules tested on the ISACA CRISC. Master the principles and controls for managing risks associated with external entities, including due diligence, contract management, and continuous monitoring, as per CRISC guidelines. VoraPrep verifies every threshold, worked table, and practice question below against the current ISACA CRISC blueprint.
How is NIST SP 800-37 tested on the ISACA CRISC?
⚠️ Exam trap: Over-reliance on initial due diligence. While crucial, initial due diligence is a snapshot. The exam expects you to understand the necessity of 'continuous monitoring' and periodic reassessments. A vendor's security posture can degrade over time. Accountability Stays: 'Accountability' for outsourced risks remains with the engaging organization, not the third party.
Where can I practice ISACA CRISC questions on Third-Party, Vendor, and Cloud Service Provider Risk?
Test yourself instantly with the free playable ISACA CRISC question on this page, or launch VoraPrep's full ISACA CRISC adaptive question bank, interactive lessons, and 1:1 exam simulator at voraprep.com/crisc.