Which two restrictions does NIST say an incident response provider contract should state? Choose two.

Answer: D. Whether the provider may share sanitised incident information with its other customers
B. Whether the provider may make and implement operational decisions such as deactivating services to contain an incident

SP 800-61r3 states the contract should include restrictions on what the service provider can do, such as sharing sanitised incident information with other customers or making and implementing operational decisions like immediately deactivating certain services to contain an incident.

Source: NIST SP 800-61 Rev. 3 (NIST) — Sec. 2.2 Roles and Responsibilities