External Audit and Compliance
What type of SOC Report tests controls over a period of time
Type 2
After the controls have been implemented what type of risk still remains ?
Residual Risk
Our main platform in which assessments are done.
ProcessUnity
Once the Business Unit confirms that the service are still being used what would be the next critical part to continue that assessment
Create the Questionnaire and Send it to the Vendor.
represents protection from unauthorized disclosure. The impact of such disclosure can range from disclosure of client’s private data, to loss of reputation, or worse
Confidentiality
What ISO standard is for Information Security Management
ISO 27001
Without considering the controls in place what type of risk is present.
Inherent Risk
Repository of contracts that are published, existing, and drafts, it also serves as the procurement tool for intake request
Ivalua
It is often done when the TPIRM has no response and there is no reference that could lead to an answer is found in the documents provided
Send a follow up to the Vendor.
represents the authorized end-user’s ability to use the system and data. Availability is lost if the risk target, whether it be information or a physical data, is not available for use, therefore impacting MFC business objectives by causing loss of normal operation or reputational damage.
What does PCI DSS Stands for
Payment Card Industry Data Security Standard
IS the process of identifying, assessing, and mitigating the risks posed by external parties that interact with your organization
Third Party Risk Management
Archer
Oftentimes this internal team is part of the assessment and handles the review and opines to the Business Continuity and Disaster Recovery aspect of the Vendor
BCM Team
represents protection from improper alteration. Integrity is lost if unauthorized changes are made to the risk target whether it be information or a physical device either intentionally or accidentally. The impact of such changes can result in fraud or inaccuracy
Integrity
What SOC stands for ?
Service Organization Controls
Manulife's Third Party Information Risk Management Policy is found at the Global Policy Database at what policy number ? (Whole Policy Code)
MFC-STA-008
Before Ivalua was introduced this was the tool in which Intakes request were submitted and IRQ information were found before being uploaded to Archer
BuySmart
Privacy Team
A CIA combination of 2 Medium and 1 High will net to an overall criticality rating of ?
Significant
What does HIPAA stands for
Health Insurance Portability and Accountability Act
Manulife's Information Risk Management Policy is found at the Global Policy Database at what policy number ? (Whole Policy Code)
MFC-TLP-001
MIR3
If a Vendor lacks the controls and has significant impact on the overall risk tolerated, what should be open - BE SPECIFIC
Archer Issue
A CIA combination of 2 Lows and 1 High will net to an overall criticality rating of ?
Significant