Vendor Management and Procurement Processes CCISO Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A company is procuring a new security information and event management (SIEM) system. The procurement team has issued an RFP and received proposals. The team is now in the evaluation phase. The CISO has identified that the RFP did not include a requirement for the SIEM to integrate with the company's existing identity management system. This integration is critical for the SIEM to function effectively. What is the most appropriate action?

   • AIssue an addendum to the RFP that adds the integration requirement and allows vendors to submit revised proposals
   • BAsk only the top-ranked vendor if it can support the integration
   • CEvaluate the proposals without the integration requirement and select the best vendor
   • DCancel the RFP and start a new procurement process
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A company has a long-term contract with a vendor that provides critical infrastructure. The vendor has recently been acquired by a larger firm, and the company's CISO is concerned about changes in the vendor's security posture and service delivery. The contract does not include a change-of-control clause. The CISO must decide how to manage this situation. What is the most appropriate action?

   • AAssume the contract remains valid and continue as before
   • BImmediately terminate the contract due to the acquisition
   • CRequest a new contract with the acquiring firm
   • DConduct a due-diligence review of the acquiring firm and reassess the vendor's risk profile
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A multinational corporation is terminating a contract with a legacy IT outsourcing vendor. The contract contains a clause requiring the vendor to return all data in a proprietary format within 30 days. The new vendor requires data in an open standard format. The CISO must ensure a smooth transition without data loss. What is the best course of action?

   • ATerminate the contract immediately and rely on backups
   • BNegotiate with the outgoing vendor to provide data in the required format, even if it requires a contract amendment
   • CAccept the data in the proprietary format and ask the new vendor to convert it
   • DExtend the contract indefinitely until the format issue is resolved
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A company is planning to terminate a contract with a cloud services vendor. The vendor hosts critical applications and data. The contract includes a 60-day transition period, but the vendor has a history of being uncooperative during transitions. The CISO must ensure a smooth exit without disrupting business operations. What is the most important consideration in the exit plan?

   • ARelying on the vendor's promise to cooperate during the transition
   • BNegotiating a longer transition period with the vendor
   • CEnsuring that data is migrated and verified before the transition period ends
   • DIncluding a clause that penalizes the vendor for non-cooperation
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A logistics company has signed a contract with a SaaS vendor for a fleet management system. The contract includes a service-level agreement (SLA) with a 99.9% uptime commitment and a response-time target for support tickets. The CISO wants to ensure the vendor meets these commitments. Which action should the CISO take?

   • ARely on the vendor's annual self-assessment report
   • BWait for the vendor to report any SLA breaches
   • CConduct a one-time security review at contract signing
   • DDefine KPIs and establish a monthly reporting process to track uptime and support response times
   Reveal Solution Discussion Select an answer first