An auditor identifies that a CSP received multiple customer inquiries and RFPs during the last month. Which of the following should be the BEST recommendation to reduce the CSP burden?

Question

Options

• ACSP can share all security reports with customers to streamline the process.
• BCSP can schedule a call with each customer.
• CCSP can answer each customer individually.
• DCSP can direct all customers' inquiries to the information in the CSA STAR registry.

• A
  9% (3)
• B
  3% (1)
• C
  3% (1)
• D
  85% (28)

Explanation

Directing customers to the CSA STAR (Security, Trust, Assurance, and Risk) registry is the most efficient solution because it is a publicly accessible, standardized repository where CSPs publish their security assessments and compliance documentation - allowing multiple customers to self-serve the same information simultaneously without repeated CSP involvement.

Why the distractors fail:

• A is problematic because not all security reports can be freely shared; many contain sensitive internal details that may violate confidentiality or contractual obligations.
• B scheduling individual calls still consumes significant CSP time and scales poorly when inquiries are numerous.
• C answering each customer individually is essentially the status quo - the inefficient approach the question is asking you to improve upon.

Memory tip: Think of STAR as a "self-service kiosk" - instead of a CSP staffing a help desk for every customer, the registry lets everyone grab the information they need off the shelf. When a question asks about reducing burden at scale, the standardized, public-facing CSA STAR registry is almost always the right lever.

No community discussion yet for this question.