1.5 Manage Security Requirements in Contracts and Agreements ISSMP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Why is it important to include regulatory compliance requirements in a service management agreement?

   • ATo reduce the organization's own legal responsibilities
   • BTo make the provider contractually obligated to meet those requirements
   • CTo avoid the need for external audits
   • DTo satisfy the provider's insurance requirements
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the purpose of corrective actions in contractual compliance monitoring?

   • ATo document the provider's compliance for regulatory reporting
   • BTo transfer compliance responsibility to the provider
   • CTo address identified non-compliance and prevent recurrence
   • DTo terminate the contract immediately
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company is negotiating a contract with a cloud provider that will host its customer data. The provider's standard agreement includes a clause that allows the provider to transfer data to third parties for subprocessing. The company operates in a jurisdiction that requires explicit consent for data transfers. The company's legal team is concerned about the subprocessing clause. What should the security manager do?

   • ARely on the provider's certifications to ensure compliance
   • BAccept the clause because the provider is responsible for compliance
   • CNegotiate to require the provider to obtain consent before any subprocessing
   • DRequire the provider to eliminate all subprocessing
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A multinational corporation is contracting with a data processing vendor that will handle personal data of EU citizens. The vendor's standard contract does not include any data protection clauses. The corporation's legal team is aware of GDPR but wants to move forward. What should the security manager ensure is added to the contract?

   • AA clause stating the vendor will follow industry best practices
   • BA clause allowing the corporation to audit the vendor at any time
   • CA clause limiting the vendor's liability to the contract value
   • DA clause requiring the vendor to comply with GDPR and applicable data protection laws
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What should be explicitly included in a contract to ensure regulatory compliance?

   • AApplicable regulatory compliance statements and requirements
   • BA list of the organization's internal security policies
   • CThe provider's marketing materials describing their security practices
   • DA general statement that the provider will comply with all laws
   Reveal Solution Discussion Select an answer first