Vendor Management and Procurement Processes CCISO Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A healthcare organization is negotiating a contract with a cloud EHR vendor. The vendor insists on a limitation of liability clause capped at the total contract value. The CISO is concerned that a data breach could cause damages far exceeding the contract value. The vendor is the only one that meets the organization's technical requirements. What is the best negotiation strategy?

   • AWalk away from the negotiation and find another vendor
   • BNegotiate for a higher liability cap or a carve-out for data breaches and security incidents
   • CAgree to the cap but require the vendor to purchase cyber insurance
   • DAccept the limitation of liability to secure the contract
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company is negotiating a contract with a new cloud provider. The provider's standard contract includes a clause that limits liability to the amount paid in the last 12 months and does not include a data-return clause at the end of the contract. The CISO is concerned about the risk of data loss if the contract is terminated. What is the most important contract term to negotiate?

   • AA clause that allows the company to terminate the contract without notice
   • BA higher liability cap that covers the full value of the data
   • CA data-return and deletion clause that specifies the format and timeline for returning data upon termination
   • DA clause that requires the provider to store data in multiple regions
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A healthcare organization is issuing an RFP for a cloud-based electronic health records system. The RFP team wants to ensure that vendors' security capabilities are comparable. Which approach should the RFP include to achieve this?

   • AEvaluate security only during the vendor demonstration phase
   • BRequire all vendors to answer the same set of security questions and provide evidence of compliance with the same standards
   • CAllow each vendor to present its security features in its preferred format
   • DAsk vendors to self-certify that they meet all applicable regulations
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which contract term is most important to negotiate to ensure the organization can hold the vendor accountable for meeting performance expectations?

   • AService-level agreements (SLAs) with measurable targets
   • BVendor's internal reporting structure
   • CPayment schedule based on calendar dates
   • DMarketing approval rights
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A financial services firm is negotiating a contract with a cloud provider for critical infrastructure. The provider's standard contract includes a clause that limits liability to the value of the contract and does not include a right to audit. The CISO wants to protect the firm's interests. Which contract term should the CISO prioritize?

   • AA right-to-audit clause that allows the firm to verify the provider's security controls
   • BA clause that requires the provider to use only locally hosted data centers
   • CA clause that automatically renews the contract for five years
   • DA limitation-of-liability cap equal to the contract value
   Reveal Solution Discussion Select an answer first