CRISC · Question #121
Which of the following provides the BEST assurance of the effectiveness of vendor security controls?
The correct answer is C. Require independent control assessments. Requiring independent control assessments provides the highest assurance of vendor security control effectiveness, as it involves an unbiased third party validating their operation.
Question
Which of the following provides the BEST assurance of the effectiveness of vendor security controls?
Options
- AReview vendor control self-assessments (CSA).
- BReview vendor service level agreement (SLA) metrics.
- CRequire independent control assessments.
- DObtain vendor references from existing customers.
How the community answered
(56 responses)- A4% (2)
- B11% (6)
- C80% (45)
- D5% (3)
Why each option
Requiring independent control assessments provides the highest assurance of vendor security control effectiveness, as it involves an unbiased third party validating their operation.
Vendor control self-assessments (CSA) are self-reported and may lack objectivity or independent verification of the control effectiveness.
Service Level Agreement (SLA) metrics typically focus on service availability and performance, not the effectiveness or implementation details of underlying security controls.
Independent control assessments, performed by a neutral third party, provide objective evidence and validation that a vendor's security controls are designed and operating effectively. This external verification minimizes bias and increases trustworthiness compared to internal assessments or customer reviews.
Vendor references from existing customers provide anecdotal evidence of satisfaction but do not offer a systematic or technical audit of security control effectiveness.
Concept tested: Vendor security control assurance
Source: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
Topics
Community Discussion
No community discussion yet for this question.