Study. uk . com
  1. Home
  2. All questions
  3. Question 246

CISM study material · question 246 of 1000

A supplier is onboarded and the first security review takes place six months into the contract. Which CSF 2.0 outcome does this arrangement miss?

  1. Supplier risks are monitored over the course of the relationship
  2. Planning and due diligence are performed to reduce risks before entering formal supplier relationships
  3. Supply chain requirements are integrated into contracts
  4. Suppliers are included in incident planning and recovery
Show the answer

Answer: B. Planning and due diligence are performed to reduce risks before entering formal supplier relationships

CSF 2.0 subcategory GV.SC-06 places planning and due diligence before entry into a formal supplier relationship, so that risk is reduced at selection rather than managed after the contract is signed.

Source: NIST CSWP 29 (NIST) — Appendix A GV.SC-06

Challenge yourself on this topic → Study as cards