Study. uk . com
  1. Home
  2. All questions
  3. Question 560

CISM study material · question 560 of 1000

An organisation begins a security service procurement by comparing vendors' offerings. Which prior step does NIST prescribe?

  1. Publishing the requirement to the open market, so that every capable supplier in the sector has an equal opportunity to respond to it
  2. Obtaining board approval for the anticipated spend in advance, so that the funding line is fully secured before any of the suppliers is approached
  3. Appointing the leader of the acquisition team, so that a single named person is accountable for the procurement from start to finish
  4. Reviewing the current state of the security programme and the controls planned or in place, so gaps drive the purchase
Show the answer

Answer: D. Reviewing the current state of the security programme and the controls planned or in place, so gaps drive the purchase

SP 800-100 states that before selecting specific services, organisations should review the current status of their security programmes and the controls either planned or in place to protect systems and data.

Source: NIST SP 800-100 (NIST) — Sec. 12.2 Selecting Information Security Services

Challenge yourself on this topic → Study as cards