A company uses a managed security service provider (MSSP) for 24/7 monitoring. The MSSP has been in place for two years, and the company's security team has never reviewed the MSSP's performance against the contract. The contract includes specific response time requirements. What should the security manager do?

Assume the MSSP is performing well since there have been no major incidents

Renegotiate the contract to remove response time requirements

Review the MSSP's performance reports against the contract's response time requirements

Conduct a one-time audit and then return to the current approach

During a merger, what is the primary security action an organization should take to manage the security impact?

Immediately decommission all systems of the acquired company

Delay all security integration until the merger is finalized

Transfer all security responsibilities to the acquired company's team

Conduct a risk assessment of the merged entity's systems and data

A healthcare organization is negotiating a contract with a cloud service provider to host patient records. The provider offers a standard service agreement with a lower price than competitors, but the agreement does not mention any specific security controls or regulatory requirements. The organization's legal team wants to finalize the contract quickly to take advantage of the pricing. What should the security manager do first?

Accept the agreement but conduct a security audit after signing

Ask the provider for a verbal commitment to comply with regulations

Sign the agreement and rely on the provider's general security certifications

Require the inclusion of explicit security controls and regulatory compliance clauses before signing

An organization has a contract with a cloud provider that includes a right-to-audit clause. The security manager suspects the provider is not meeting the agreed security controls. What should the security manager do to verify compliance?

Ask the provider to sign a new compliance statement

Rely on the provider's self-reported compliance reports

Terminate the contract based on suspicion

Conduct an on-site audit of the provider's facilities and systems

An organization has a contract with a software vendor that includes a clause requiring the vendor to provide security patches within 48 hours of a vulnerability disclosure. The vendor has missed the deadline three times in the past six months. What should the security manager do?

Terminate the contract immediately

Ignore the missed deadlines because the vendor is generally reliable

Issue a formal notice of non-compliance and require a corrective action plan

Reduce the contract price to reflect the missed deadlines

Information Systems Security Management Professional

Domain 1Objective 5

1.5 Manage Security Requirements in Contracts and Agreements ISSMP Practice Questions (Page 1)

Part of the Leadership and Organizational Management domain, which accounts for 21% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 2–3 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

5concepts

21%of the exam

Questions 1–5

1application · medium
A company uses a managed security service provider (MSSP) for 24/7 monitoring. The MSSP has been in place for two years, and the company's security team has never reviewed the MSSP's performance against the contract. The contract includes specific response time requirements. What should the security manager do?
Select an answer first
2foundation · easy
During a merger, what is the primary security action an organization should take to manage the security impact?
Select an answer first
3application · medium
A healthcare organization is negotiating a contract with a cloud service provider to host patient records. The provider offers a standard service agreement with a lower price than competitors, but the agreement does not mention any specific security controls or regulatory requirements. The organization's legal team wants to finalize the contract quickly to take advantage of the pricing. What should the security manager do first?
Select an answer first
4application · medium
An organization has a contract with a cloud provider that includes a right-to-audit clause. The security manager suspects the provider is not meeting the agreed security controls. What should the security manager do to verify compliance?
Select an answer first
5application · medium
An organization has a contract with a software vendor that includes a clause requiring the vendor to provide security patches within 48 hours of a vulnerability disclosure. The vendor has missed the deadline three times in the past six months. What should the security manager do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.

1.5 Manage Security Requirements in Contracts and Agreements ISSMP Practice Questions (Page 1)

Questions 1–5

During a merger, what is the primary security action an organization should take to manage the security impact?

An organization has a contract with a cloud provider that includes a right-to-audit clause. The security manager suspects the provider is not meeting the agreed security controls. What should the security manager do to verify compliance?

An organization has a contract with a software vendor that includes a clause requiring the vendor to provide security patches within 48 hours of a vulnerability disclosure. The vendor has missed the deadline three times in the past six months. What should the security manager do?

Keep studying — Leadership and Organizational Management