Study. uk . com
  1. Home
  2. All questions
  3. Question 495

CISM study material · question 495 of 1000

A supplier suffers a disruption but does not report it, arguing it was not serious. Which contract provision does NIST say should have prevented the dispute?

  1. A penalty clause for late reporting
  2. Baseline criteria in the contract determining whether a disruption qualifies as serious
  3. A right for the organisation to monitor the supplier's network
  4. A requirement to report every operational event without exception, however minor, within one working day of it occurring
Show the answer

Answer: B. Baseline criteria in the contract determining whether a disruption qualifies as serious

SP 800-161r1 states contracts should set processes and protocols for communicating and reporting vulnerabilities, incidents and other business disruptions, including acceptable deviations and baseline criteria to determine whether a disruption qualifies as serious.

Source: NIST SP 800-161 Rev. 1 (NIST) — Sec. 3.1.2 The Role of C-SCRM in the Acquisition Process

Challenge yourself on this topic → Study as cards