Which of the following is not a stage in the OCC lifecycle framework for third party risk?

• A. Planning
• B. Ongoing Monitoring
• C. Data Encryption
• D. Termination

Answer: (C)

In this framework, the lifecycle of third-party risk management centers on how you plan, oversee, and wind down a relationship. Planning establishes scope, governance, and initial risk assessment; ongoing monitoring keeps tabs on the third party’s controls, performance, and risk over time; and termination covers secure disengagement, data return or destruction, and offboarding when the relationship ends. Data encryption, while a crucial security control for protecting data, is not a distinct stage of the lifecycle itself. It’s a protective measure that can be employed across many stages, but the OCC framework treats encryption as part of the broader security program rather than one of the lifecycle phases.