Study. uk . com
  1. Home
  2. All questions
  3. Question 38

CompTIA Security+ study material · question 38 of 611

After a supplier incident, an organisation asks to review the supplier's security evidence and is refused. What should have been in place?

  1. A higher CVSS threshold in the contract
  2. A memorandum of understanding
  3. A right-to-audit clause in the agreement
  4. A signed acceptable use policy
Show the answer

Answer: C. A right-to-audit clause in the agreement

Without a contractual right agreed in advance, the supplier has no obligation to open its records after an incident.

Source: NIST SP 800-161 Rev. 1 (NIST) — SP 800-161 Rev. 1 › Agreements

Challenge yourself on this topic → Study as cards