1.5 Manage Security Requirements in Contracts and Agreements ISSMP Practice Questions (Page 6)

Questions 26–27

1. 26expert · hard

   A company is planning to outsource its data center operations to a third-party provider. The provider's service agreement includes a clause that limits its liability to the value of the contract. The company's security team has identified that the provider's security controls are weaker than the company's current controls. The company's legal team is concerned about the liability clause. What should the security manager do?

   • AAccept the security controls but require the provider to purchase additional insurance
   • BNegotiate to strengthen the security controls and increase the liability cap
   • CReject the contract and keep data center operations in-house
   • DAccept the liability clause because the provider is a large, reputable company
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company is planning to outsource its application development to a vendor in another country. The vendor will have access to the company's source code and customer data. The company operates in a jurisdiction with strict data protection laws. What should the security manager ensure is included in the outsourcing contract?

   • AA clause that transfers all liability for data breaches to the vendor
   • BA clause that limits the vendor's access to only the source code
   • CClauses that address data protection, regulatory compliance, and security controls
   • DA clause that allows the vendor to use subcontractors without approval
   Reveal Solution Discussion Select an answer first