問題文
A supermarket chain outsources its loyalty program to a supplier that will hold member records. Which step during supplier selection does most to keep the chain's own accountability intact?
選択肢
- Require that the supplier's staff complete the supermarket chain's own annual security awareness training, so that everyone who touches member records has received the same briefing as the chain's employees.
- Ask the supplier for a copy of any security certificate that it holds and keep that certificate on file as the record of the assessment, since an independent body has already examined the supplier's controls on the chain's behalf.
- Set out the security requirements, the right to assess the supplier and the breach notification duties in the contract before it is signed because that is the last point at which they can be negotiated.
- Arrange for the member records to be encrypted by the supplier, so that the records cannot be read even if the supplier's environment is breached at some point during the term of the arrangement.