A healthcare insurance organization chose a vendor to develop a software application. Upon review of the draft contract, the information security professional notices that software security is not addressed. What is the BEST approach to address the issue?

Question

Ilya Shadrin · Accepted Answer

Update the contract so that the vendor is obligated to provide security capabilities.

Ilya Shadrin · Answer

Update the service level agreement (SLA) to provide the organization the right to audit the vendor.

Ilya Shadrin · Answer

Update the service level agreement (SLA) to require the vendor to provide security capabilities.

Ilya Shadrin · Answer

Update the contract to require the vendor to perform security code reviews.

Question list

List of questions

Question 1

(1)

Question 2

(0)

Question 3

(0)

Question 4

(0)

Question 5

(0)

Question 6

(0)

Question 7

(0)

Question 8

(0)

Question 9

(0)

Question 10

(0)

Related questions

Question 1082 - CISSP discussion

Suggested answer: C

0 comments