3.2 Manage Security Risks Within the Supply Chain (e.g., Supplier, Vendor, Third-Party Risk, Contracts) ISSMP Practice Questions (Page 7)

Questions 31–32

1. 31application · medium

   A multinational corporation is evaluating a new software vendor that will have access to its customer database. The vendor has passed initial due diligence, but the corporation wants to ensure that the vendor's security controls are actually effective before granting access. What is the BEST next step?

   • ARely on the vendor's SOC 2 Type II report as sufficient evidence of control effectiveness.
   • BInclude a contractual clause requiring the vendor to maintain security controls.
   • CAccept the vendor's self-assessment questionnaire as adequate verification.
   • DConduct an on-site security audit of the vendor's development and data center facilities.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is an example of a supply chain risk introduced by a third-party vendor?

   • AThe vendor's stock price fluctuation
   • BThe vendor's employees having access to sensitive data
   • CThe vendor's office having a cafeteria
   • DThe vendor's use of a popular email service
   Reveal Solution Discussion Select an answer first