Which of the following is a driver for third party risk assessments?

• A. ISO 27002
• B. HIPAA/HiTech
• C. EU GDPR
• D. NIST Cybersecurity Framework

Answer: (A)

The first thing to recognize is the need for a clear, shared security baseline when evaluating every third party. ISO 27002 provides a broad, widely adopted catalog of information security controls and control objectives. Organizations use this catalog to define what a vendor should implement and demonstrate, across areas like how supplier relationships are managed, how access to systems and data is controlled, how information is protected, how incidents are handled, and how vulnerabilities are managed. That makes ISO 27002 a natural driver for third-party risk assessments because it gives a concrete, common standard to measure vendors against, guide due diligence, shape contract requirements, and drive ongoing monitoring.

HIPAA/HiTech focuses on healthcare data privacy and breach notification, not a general baseline for all vendors. GDPR centers on data protection rights and privacy-by-design requirements, not a universal controls catalog for vendor risk. The NIST Cybersecurity Framework offers a risk-management framework and maturity structure, but it does not prescribe a universal set of controls the way ISO 27002 does.