CAS-002 · Question #298
An organization is finalizing a contract with a managed security services provider (MSSP) that is responsible for primary support of all security technologies. Which of the following should the…
The correct answer is B. An interconnection security agreement. When an MSSP connects to and manages an organization's security infrastructure, an Interconnection Security Agreement (ISA) is required to formally document the security requirements governing that technical interconnection.
Question
An organization is finalizing a contract with a managed security services provider (MSSP) that is responsible for primary support of all security technologies. Which of the following should the organization require as part of the contract to ensure the protection of the organization's technology?
Options
- AAn operational level agreement
- BAn interconnection security agreement
- CA non-disclosure agreement
- DA service level agreement
How the community answered
(32 responses)- A3% (1)
- B94% (30)
- C3% (1)
Why each option
When an MSSP connects to and manages an organization's security infrastructure, an Interconnection Security Agreement (ISA) is required to formally document the security requirements governing that technical interconnection.
An Operational Level Agreement (OLA) is an internal agreement between departments within the same organization and does not govern third-party vendor relationships or interconnection security.
An Interconnection Security Agreement (ISA) is specifically designed to document security requirements when two organizations' IT systems are connected. Since the MSSP will have primary support of all security technologies, their systems must interconnect with the organization's environment, making an ISA the appropriate contractual mechanism to define how that connection is secured and controlled.
A Non-Disclosure Agreement (NDA) protects confidential information from being disclosed but does not address technical security requirements or protections for interconnected systems.
A Service Level Agreement (SLA) defines performance metrics and uptime guarantees but does not specifically govern the security requirements for how an MSSP's systems interconnect with the organization's infrastructure.
Concept tested: Interconnection Security Agreement for third-party MSSP contracts
Source: https://csrc.nist.gov/publications/detail/sp/800-47/rev-1/final
Topics
Community Discussion
No community discussion yet for this question.