A is not correct - By classifying data you can communicate the sensitivity and criticality of Data. Doesn't mean that they will adhere to security requirements.
B - is the most correct answer as INDEPENDENT audits show the state of security controls of the security vendor.
C - is not correct - what if the vendor has shiny policies but implements no controls at all?
D - is not correct. High penalties may induce the vendor to avoid security breaches, but an independent audit report is more credible in this context.
upvoted 1 times
...
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Josef4CISM
1 month, 1 week ago