RANGER CompTIA Security+ (SY0-701) · chapter 23 of 27
Month 7: Vendors, contracts and the law
In this chapter Objectives 5.3, 5.4
Objective 5.3
Third-party risk
Vendor assessment
How you check a vendor before and after signing:
- Penetration testing: test the vendor's systems (with permission) or review their recent pen test results.
- Right-to-audit clause: contract term letting you audit the vendor's security.
- Evidence of internal audits: the vendor's own audit reports and remediation.
- Independent assessments: reports from outside auditors (such as SOC 2 or ISO 27001 certification).
- Supply chain analysis: look at the vendor's own suppliers and components, since their risk flows to you.
Vendor selection, questionnaires, monitoring, rules of engagement
Due diligence: investigate a vendor before choosing it (security, finances, reputation, legal history). Conflict of interest: make sure no one choosing the vendor gains personally from the choice. Questionnaires collect a vendor's answers about its controls in a standard format. Vendor monitoring continues after signing (reviews, reports, breach news). Rules of engagement set what is allowed when testing or working with a vendor: scope, timing, contacts and limits.
Agreement types
Know each agreement by its job:
- SLA (service-level agreement): measurable service levels (uptime 99.9%, response within 1 hour) and penalties.
- MOU (memorandum of understanding): a statement of intent between parties; usually not legally binding.
- MOA (memorandum of agreement): more formal; parties agree to specific conditions and roles.
- MSA (master service agreement): general legal terms for all future work together.
- WO/SOW (work order/statement of work): the specific job, deliverables, timeline and cost under the MSA.
- NDA (non-disclosure agreement): keeps shared information confidential.
- BPA (business partners agreement): terms for a partnership: ownership stake, profit sharing, decisions.
Exam tip Memory trick: MSA = the rulebook for the whole relationship; SOW = this one job.
Objective 5.4
Compliance and privacy
Compliance reporting and consequences
Compliance reporting can be internal (to management and the board, tracking how well rules are followed) or external (to regulators, card brands, customers). Consequences of non-compliance: fines, sanctions (restrictions or penalties imposed by regulators or governments), reputational damage, loss of license (losing the right to operate or to process cards) and contractual impacts (breached contracts, lost customers).
Compliance monitoring
Due diligence/care: due diligence is investigating and understanding your obligations and risks; due care is acting on them responsibly (doing the reasonable things a prudent organization would). Attestation and acknowledgement: people formally confirm they read and accept policies, and leaders sign statements that controls are in place. Monitoring is both internal and external (your own checks plus auditors and regulators). Automation tracks compliance continuously with tools instead of yearly spreadsheets.
Exam tip Memory trick: due diligence = do your homework. Due care = do the right thing about it.
Privacy
Privacy laws have legal implications at each level: local/regional (state laws), national (country laws) and global (GDPR covers EU residents' data anywhere). The data subject is the person the data is about. The controller decides why and how personal data is processed; the processor processes it for the controller. Ownership sets who is accountable for the data. A data inventory lists what personal data you hold and where; retention keeps it only as long as needed. The right to be forgotten lets a data subject ask for their data to be erased.
Check yourself 1Kibble & Co. and FetchLogix sign one contract with the general legal terms for all future work. Each new delivery project then gets its own document listing deliverables, dates and price. What is that per-project document?
- Statement of work
- Master service agreement
- Memorandum of understanding
- Business partners agreement
Show the answer
Answer: A. Statement of work
A statement of work (or work order) defines one specific job under the master service agreement.
Check yourself 2A customer emails asking Kibble & Co. to delete all personal data it holds about her. Which privacy concept is she using?
- Data retention
- Right to be forgotten
- Data inventory
- Attestation
Show the answer
Answer: B. Right to be forgotten
The right to be forgotten lets a data subject ask for her personal data to be erased.
CompTIA, A+, Network+, Security+ and Linux+ are trademarks of CompTIA, Inc. Ranger Gamez is not affiliated with or endorsed by CompTIA. The practice questions are written to the published exam objectives; they are not real exam questions.