Practice Question · CISSP Study Group

Practice Question

An international trading organization that holds an International Organization for Standardization (ISO) 27001 certification is seeking to outsource their security monitoring to a managed security service provider (MSSP). The trading organization’s security officer is tasked with drafting the requirements that need to be included in the outsourcing contract. Which of the following MUST be included in the contract?

A. A detailed overview of all equipment involved in the outsourcing contract

B. The MSSP having an executive manager responsible for information security

C. The right to perform security compliance tests on the MSSP’s equipment

D. The right to audit the MSSP’s security process

6 votes

1 comment