Which of the following is the MOST important process that an information security manager needs
to negotiate with an outsource service provider?
A.
The right to conduct independent security reviews
B.
A legally binding data protection agreement
C.
Encryption between the organization and the provider
D.
A joint risk assessment of the system
Explanation:
A key requirement of an outsource contract involving critical business systems is the
establishment of the organization’s right to conduct independent security reviews of the provider’s
security controls. A legally binding data protection agreement is also critical, but secondary to
choice A, which permits examination of the actual security controls prevailing over the system and.
as such, is the more effective risk management tool. Network encryption of the link between the
organization and the provider may well be a requirement, but is not as critical since it would also
be included in choice A. A joint risk assessment of the system in conjunction with the outsource
provider may be a compromise solution, should the right to conduct independent security reviews
of the controls related to the system prove contractually difficult.