A Chief Information Security Officer (CISO) is working with a consultant to perform a gap assessment prior to an upcoming audit. It is determined during the assessment that the organization lacks controls to effectively assess regulatory compliance by third-party service providers. Which of the following should be revised to address this gap?
A) Privacy policy
B) Work breakdown structure
C) Interconnection security agreement
D) Vendor management plan
E) Audit report

Question

Quizplus · Accepted Answer

The Vendor Management Plan should be revised to include controls for assessing regulatory compliance by third-party service providers, ensuring they meet the organization's compliance requirements.

A Chief Information Security Officer (CISO) Is Working with a Consultant