nerdexam
(ISC)2

CSSLP · Question #364

A regional insurance provider requires a written "need to acquire" declaration before approving any software purchase. What specific elements does that declaration list? (Choose 3)

The correct answer is A. Assurance case C. Documented business case D. Defined product scope and boundaries. A "need to acquire" declaration for software purchases typically outlines the justification, boundaries, and assurance aspects of the proposed acquisition. It serves as a formal statement justifying the procurement before approval.

Secure Software Lifecycle Management

Question

A regional insurance provider requires a written "need to acquire" declaration before approving any software purchase. What specific elements does that declaration list? (Choose 3)

Options

  • AAssurance case
  • BEstimated total lifecycle cost
  • CDocumented business case
  • DDefined product scope and boundaries

How the community answered

(29 responses)
  • A
    93% (27)
  • B
    7% (2)

Why each option

A "need to acquire" declaration for software purchases typically outlines the justification, boundaries, and assurance aspects of the proposed acquisition. It serves as a formal statement justifying the procurement before approval.

AAssurance caseCorrect

An assurance case provides evidence and arguments that the software will meet its security and safety requirements, which is crucial for risk management in an acquisition.

BEstimated total lifecycle cost

While estimated total lifecycle cost is a critical financial consideration for any acquisition, it is usually part of the documented business case rather than a standalone element listed directly in a "need to acquire" declaration's primary elements, which focus more on strategic justification and scope.

CDocumented business caseCorrect

A documented business case articulates the strategic rationale, financial justification, and expected benefits of acquiring the software, demonstrating its value to the organization.

DDefined product scope and boundariesCorrect

Defined product scope and boundaries clarify what the software will and will not do, establishing clear expectations and preventing scope creep during and after acquisition.

Concept tested: Software acquisition documentation

Topics

#Software acquisition#Business justification#Project initiation#Assurance case

Community Discussion

No community discussion yet for this question.

Full CSSLP Practice