Study. uk . com
  1. Home
  2. All questions
  3. Question 494

CISM study material · question 494 of 1000

An organisation assesses a supplier thoroughly at award and never again during a five-year contract. Which contract management practice does NIST expect?

  1. An annual price review tied to security performance
  2. Periodic revalidation that the supplier still adheres to security requirements
  3. Replacement of the supplier at the mid-point of the contract to refresh the assurance position
  4. Transfer of assurance responsibility to the supplier under the terms of its own contract
Show the answer

Answer: B. Periodic revalidation that the supplier still adheres to security requirements

SP 800-161r1 builds periodic revalidation of a supplier's adherence to the security requirements into contract management, so compliance is shown to continue rather than assumed from award.

Source: NIST SP 800-161 Rev. 1 (NIST) — Sec. 3.1.2 The Role of C-SCRM in the Acquisition Process

Challenge yourself on this topic → Study as cards