Which statement best describes the relationship between standards and policies in third party risk management?

• A. Standards are what you execute to enforce policies
• B. Standards are higher-level policy statements
• C. Standards are the risk register
• D. Standards are vendor contracts

Answer: (A)

Standards translate policies into concrete, actionable requirements that you implement to enforce them. Policies set the goals, expectations, and risk appetite—what you want to achieve with vendors. Standards take those ideas and specify exactly how to meet them: the specific controls, configurations, procedures, and criteria you must follow, plus how you’ll measure and verify compliance. This makes enforcement consistent across all vendors and provides a clear basis for audits and assessments. For example, a policy might require strong data protection; the standard would define encryption algorithms, key lengths, key management practices, access controls, and logging. By turning the policy into precise, repeatable steps, standards enable practical governance and accountability. The other options describe different things: standards aren’t higher-level policy statements, they aren’t the risk register, and they aren’t vendor contracts.