Extended Capabilities
About 5% of the CIS-RC exam — see all 7 domains.
Beyond the core three: Third-party Risk Management (TPRM) (third-party/supplier risk and assessments; formerly Vendor Risk Management, renamed in Vancouver), Business Continuity Management (BCM), Operational Resilience, Privacy Management, integrations (CMDB, Security Operations / SecOps, identity, external GRC data, content packs/UCF), and Performance Analytics (PA) dashboards and content packs for GRC reporting and trend analysis. Continuous monitoring and metrics extend automation.
Sample questions from this domain
Three of the 15 in this domain, with the reasoning. The full set is in the question bank.
Which application extends GRC to manage risk associated with third parties such as suppliers?
- A. Third-party Risk Management (formerly Vendor Risk Management) ✓
- B. Regulatory Change Management (with regulatory event alerts)
- C. Business Continuity Management (with business impact analysis)
- D. Compliance Case Management (with case and request workflows)
Why: Third-party Risk Management (TPRM, called Vendor Risk Management before the Vancouver release) extends GRC to identify, assess, and mitigate risk from third-party relationships such as suppliers, with due diligence, assessments, and the Third-party portal. Regulatory Change Management tracks regulatory updates and their impact. Business Continuity Management plans for disruptions through business impact analysis and continuity plans. Compliance Case Management handles compliance cases such as complaints and breaches. None of these manages third-party risk.
What is a primary function of integrating GRC with external data sources or security tools?
- A. To replace control attestations with scores reported by the external tool so owners need not attest
- B. To automate indicators and evidence collection so control/risk monitoring reflects real operational data ✓
- C. To push GRC risk scores back to external tools so they can block changes above risk appetite
- D. To let external security tools create entities directly, so entity types and filters are not needed
Why: Integrations feed automated indicators and evidence so control and risk monitoring reflects real operational data, for example the Risk Management and Vulnerability Response integration that uses indicators to flag high-impact vulnerabilities. External data supplements attestation and testing rather than replacing attestations. GRC integrations bring data in; they do not push risk scores out to gate configuration changes. Entities are still generated by entity types and filters from source tables.
Which capabilities are commonly considered extended/adjacent to core GRC? (Choose two)
- A. Policy and Compliance Management
- B. Risk register management
- C. Audit engagement planning
- D. Third-party Risk Management ✓
- E. Business Continuity Management ✓
Why: Third-party Risk Management (formerly Vendor Risk Management) and Business Continuity Management are extended IRM capabilities built on the GRC framework. Policy and Compliance Management is a core GRC application, and audit engagement planning is core Audit Management. Maintaining the risk register is core Risk Management, not an extended capability.