Assess a supplier you cannot audit

applied · 70 min · Objective 1.7

Task

Apply objective 1.7: assess one real third party using only the assurance they actually publish, and state precisely what each piece of evidence does and does not establish.

Steps

  1. Write lab/supplier.csv with header evidence_type,who_performed,scope_statement,period,age_days,establishes,does_not_establish.
  2. Record every piece of assurance the supplier publishes: self-assessment, certification, attestation report, status page, contractual commitments.
  3. For each certification, transcribe the SCOPE STATEMENT verbatim and state whether it covers the service you actually use. This is the step that catches the common failure.
  4. Assess the dependency: what the supplier can reach, how quickly their failure hurts you, and whether your assurance is proportionate to that rather than to your spend. Write it in lab/supplier-dependency.md.
  5. Identify one FOURTH party -- a provider your supplier depends on -- and record what you can and cannot learn about it.

Verify

awk -F, 'NR>1 && NF>=7 {n++} END {print n" evidence row(s)"}' lab/supplier.csv
awk -F, 'NR>1 && $3=="" {n++} END {print n+0" with no scope statement"}' lab/supplier.csv
grep -Eci 'reach|access|how quickly|dependency' lab/supplier-dependency.md
grep -Eci 'fourth|sub-?processor|underlying' lab/supplier-dependency.md

Three or more evidence types, ZERO certifications without a transcribed scope statement, and a fourth party named. An assessment that concluded 'they are certified' without reading the scope has reproduced the failure the lesson describes.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.