You are reviewing a Service Level Agreement between your company and a Web development vendor. Which of the following are security requirements you should look for in this SLA? Each correct answer…

Time to respond to bug reports is a security requirement because unpatched vulnerabilities create exploitable risk windows; the SLA must define maximum response and remediation timeframes to enforce accountability.

Encryption standards specify which algorithms and key lengths the vendor must use to protect data in transit and at rest, ensuring the vendor meets the organization's minimum security baseline.

Security monitoring requirements define how the vendor will detect, log, alert on, and report security events, which is essential for timely incident response and regulatory compliance.

Guarantees on known security flaws hold the vendor contractually responsible for patching disclosed vulnerabilities within agreed timelines, directly reducing the organization's exposure to published exploits.