CISSP: Certified Information Systems Security Professional

By ISC · Question Mode

QuestionQ80

VerifiedSoftware Development Security

A healthcare insurance organization selected a vendor to develop a software application. When reviewing the draft contract, an information security professional finds that software security is not covered. What is the BEST way to address this issue?

Explanation

Security requirements for a vendor-developed application must be included as enforceable contractual obligations. This ensures the vendor is responsible for delivering the required security capabilities; a code-review requirement is too narrow, and an SLA is intended primarily for measurable service-performance commitments.

Community Discussion

No comments yet. Be the first to start the discussion!