Study. uk . com
  1. Home
  2. All questions
  3. Question 245

CISM study material · question 245 of 1000

An organisation applies the same assurance questionnaire to every one of its 900 suppliers and cannot complete the programme. Which CSF 2.0 outcome would address this?

  1. Suppliers are known and prioritised by criticality
  2. Security requirements are integrated into contracts with suppliers
  3. Due diligence is performed before entering supplier relationships
  4. Suppliers are included in incident planning, response and recovery activities
Show the answer

Answer: A. Suppliers are known and prioritised by criticality

CSF 2.0 subcategory GV.SC-04 expects suppliers to be known and prioritised by criticality, which is what directs limited assurance effort to the relationships that matter most.

Source: NIST CSWP 29 (NIST) — Appendix A GV.SC-04

Challenge yourself on this topic → Study as cards