An enterprise is developing a baseline cybersecurity standard its suppliers must meet before being awarded a contract. Which of the following statements is TRUE about the baseline cybersecurity…

Expressing requirements as general requirements is too vague and provides insufficient specificity for suppliers to implement consistent, measurable controls, undermining the purpose of a baseline standard.

Legal terminology is appropriate for contracts and agreements but is not ideal for a cybersecurity baseline standard, as it can be ambiguous regarding specific security expectations and difficult for supplier security teams to interpret and implement.

Supplier-facing cybersecurity baseline standards must be written in business terminology because suppliers span diverse industries and may not have technical cybersecurity expertise. Business language ensures the requirements are understandable, actionable, and contractually enforceable across a broad supplier base without assuming technical knowledge. This approach aligns with supply chain risk management frameworks like NIST SP 800-161, which emphasize communicating requirements in terms meaningful to the business relationship.

Technical requirements are appropriate for internal IT or engineering teams but are unsuitable as the primary expression of a supplier baseline standard, since many supplier stakeholders lack the technical background needed to interpret and act on such language.