Exam CISSP topic 1 question 70 discussion

A baseline cybersecurity standard should be expressed in technical requirements to ensure clear and measurable expectations for suppliers. A baseline cybersecurity standard should clearly outline specific technical requirements that suppliers must meet to ensure they adhere to the necessary security controls and best practices. This approach ensures that suppliers implement concrete measures to protect against cyber threats, aligning with recognized industry standards and frameworks such as ISO 27001 and NIST CSF.

Not C. Business terms help communicate with executives, but a standard for suppliers must include specific technical criteria.

Technical

I go for Technical

The correct answer is B. It should be expressed as technical requirements. Baseline cybersecurity standards should be expressed as technical requirements because they need to provide clear, actionable guidelines that suppliers must follow to ensure their systems and processes meet the necessary security criteria. Technical requirements are specific and measurable, making it easier to assess compliance and enforce the standards Option C, "It should be expressed in business terminology," is incorrect because baseline cybersecurity standards need to provide clear, actionable guidelines that can be directly implemented by technical teams. Expressing these standards in technical requirements ensures that they are specific, measurable, and enforceable, which is crucial for maintaining security and compliance12. Business terminology might be too broad or vague, making it difficult for technical teams to understand and implement the necessary security measures. Technical requirements, on the other hand, provide the detailed instructions needed to effectively secure systems and data

The question asks about a baseline cybersecurity standard that suppliers must meet before being awarded a contract. The key here is ensuring that the standard is clear, actionable, and measurable in terms of security expectations. B. It should be expressed as technical requirements is indeed the best answer. Cybersecurity standards must clearly define the specific security measures, and only technical requirements can ensure the correct implementation of these measures.

A baseline cybersecurity standard should be expressed in technical requirements to ensure clear and measurable expectations for suppliers. This includes specific controls, technologies, and processes that must be implemented. While general requirements can provide a high-level overview, technical requirements are essential for effective evaluation and enforcement of the standard. Here's a breakdown of why the other options are less effective: A. General requirements: Too vague and difficult to enforce. C. Business terminology: While understanding business needs is important, the standard should focus on technical implementation details. D. Legal terminology: While legal considerations are important, the primary focus should be on technical requirements to ensure effective security.

B. Its a cybersecurity standard so I will guess its a cyber Vendors

Here’s why C. It should be expressed in business terminology is appropriate: Clarity for Stakeholders: Using business terminology helps ensure that all stakeholders, including suppliers, understand the expectations and the rationale behind them. This approach promotes better alignment and cooperation. Alignment with Business Objectives: Expressing cybersecurity requirements in business terms ensures that they are seen as integral to achieving business goals, rather than as isolated technical mandates. Effective Communication: Managers and executives need to communicate security requirements in a way that resonates with the business context, making it easier for suppliers to see the value and necessity of compliance.

Standards must be set to meet business goals. If it does not meet business needs then it’s useless.

this is related to SLR before signing the contract.

Baseline is the keyword

Refer to chapter 1 the description of SLA and SLR . It talk about the third party or company of your supply chain shall has minimum security standards. It relates with business. Technical details was developed by third-party company by following your business requirements. You don't give then the details of Technical.

C. Business Terminology

Answer C) It should be expressed in business terminology. Too technical or legal and you may confuse your vendor(s).

C. It should be expressed in business terminology.

Think like a manager guys. Using business terminology to express technical security things to other stakeholders is what a manager would do. You don't want to use too technical or even legal terminology when communicating with other stakeholders like suppliers. Business terminology is what you want to use when communicating security baselines to prospective suppliers. Remember, you want to think like an executive or a manager not an engineer.