Study. uk . com
  1. Home
  2. All questions
  3. Question 717

CISM study material · question 717 of 1000

An organisation contracts a provider to perform incident detection and response. Which two things does NIST say the contract must define? Choose two.

  1. The provider's own internal staff appraisal process and its published criteria for promotion
  2. The division of responsibilities, including information flows and coordination
  3. The provider's own choice of detection tooling for the whole of the estate
  4. The provider's authority to act on the organisation's behalf
Show the answer

Answer: B. The division of responsibilities, including information flows and coordination
D. The provider's authority to act on the organisation's behalf

SP 800-61r3 describes this as a shared responsibility model in which some responsibilities transfer to the provider, and states these should be clearly defined in a contract with the team aware of the division including information flows, coordination and authority to act.

Source: NIST SP 800-61 Rev. 3 (NIST) — Sec. 2.2 Roles and Responsibilities

Challenge yourself on this topic → Study as cards