712-50 Question 431
Single answerA global manufacturing company is issuing an RFP for a third-party provider to host a new supplier collaboration platform that will process proprietary design files, employee data, and limited customer warranty information across multiple jurisdictions. The procurement team wants to accelerate award by using the vendor's standard contract language and evaluating bids primarily on cost and implementation speed. As the CISO, you are asked to review the acquisition package before release. Which action is the MOST effective way to ensure risk-based security requirements are embedded into the procurement process and can be enforced after award?
- A
Require the selected vendor to complete a security questionnaire after contract award, and use the results to negotiate security improvements during implementation.
- B
Add general language requiring the vendor to follow industry best practices, while leaving detailed security controls to be defined in operational procedures after go-live.
- C
Incorporate security and privacy requirements into the statement of work, contract clauses, service level agreements, and evaluation criteria, including measurable obligations for incident reporting, access control, data protection, audit rights, and regulatory compliance, with associated cost estimates in the acquisition plan.
- D
Ask Internal Audit to perform a post-selection review of the procurement file to confirm whether the chosen vendor's security program appears reasonable for the business need.
Show answer and explanation
Correct answer: C
Explanation
The best answer is Option 3 because mature third-party risk management requires security and privacy requirements to be defined before contract award and aligned to business risk, data sensitivity, regulatory exposure, and service criticality. In practice, this means translating risk assessments into procurement artifacts: acquisition plans should identify the security risk profile and required budget; statements of work should describe required controls and deliverables; contracts should include enforceable clauses for security obligations, incident response, data use, retention, return/destruction, subcontractor management, and audit rights; SLAs should define measurable performance and security expectations; and evaluation factors for award should score vendors on their ability to meet these requirements, not just cost and speed.
This approach aligns with widely accepted practices reflected in frameworks such as NIST SP 800-161 for supply chain risk management, NIST SP 800-53 control families related to acquisition and system/services acquisition, and general procurement governance principles used in enterprise security programs. From a CCISO perspective, the key leadership principle is to ensure that security is contractually embedded, risk-based, measurable, budgeted, and part of source selection, not left to informal understandings or post-award remediation.
- A. Incorrect.
This is incorrect because it defers key security requirements until after award, when the organization's negotiating leverage is reduced and remediation may increase cost and delay. A post-award questionnaire can be useful for due diligence, but it does not ensure that enforceable, risk-based requirements were included in the acquisition documents. A common misconception is that vendor assessments alone can substitute for contractual security requirements; they cannot.
- B. Incorrect.
This is incorrect because vague references to 'industry best practices' are difficult to measure, enforce, or audit. Without explicit requirements in procurement documents, the vendor can meet only minimal expectations and still remain contractually compliant. Candidates may choose this option because it sounds flexible, but flexibility without specificity creates legal and operational gaps, especially for incident reporting timelines, data handling, and assurance rights.
- C. Correct.
This is correct because it embeds security into the full procurement lifecycle rather than treating it as a later operational issue. Risk-based requirements should be reflected in acquisition planning, cost estimates, the statement of work, contract terms, source selection criteria, and service levels. Measurable obligations such as breach notification timeframes, encryption requirements, privileged access controls, logging, right-to-audit, subcontractor restrictions, data residency, and regulatory obligations allow the organization to evaluate vendors consistently and enforce requirements after award. Including associated cost estimates also ensures security is budgeted rather than omitted during implementation.
- D. Incorrect.
This is incorrect because a post-selection review by Internal Audit is detective rather than preventive. It may identify weaknesses, but it does not help shape the vendor selection criteria or create enforceable contract obligations before award. Some may choose this option because audit provides independent assurance, but assurance after selection is not a substitute for integrating security requirements into procurement documents up front.