CSL Cybersecurity Contract Law & Vendor Management 3

Question 1

How does cyber insurance typically interact with vendor contract requirements?

Accepted Answer

Vendor contracts often require vendors to carry specified cyber insurance coverage and name clients as additional insureds

Answer

Cyber insurance is a government program covering breach costs for all companies

Answer

Cyber insurance replaces the need for security provisions in vendor contracts

Answer

Cyber insurance is only required for federal government contractors

Question 2

Under the concept of 'vicarious liability,' when might a company be held responsible for a vendor's cybersecurity negligence?

Accepted Answer

When the company has sufficient control over the vendor's operations or the vendor acts as the company's agent

Answer

Only when the vendor is a foreign entity

Answer

Only when the company explicitly authorized the negligent act in writing

Answer

Never, as vendors are always independently and exclusively liable

Question 3

What is a security assessment questionnaire (SAQ) used for in vendor management?

Accepted Answer

To evaluate a vendor's security posture before and during a contractual relationship

Answer

To train vendor employees on cybersecurity awareness

Answer

To contractually transfer cybersecurity risk to the vendor

Answer

To satisfy government audit requirements on behalf of the client

Question 4

What does 'source code escrow' refer to in software vendor contracts with security implications?

Accepted Answer

A neutral third-party arrangement where source code is deposited for client access if the vendor goes out of business

Answer

A payment holdback mechanism for poor security performance

Answer

A government-mandated data backup requirement for critical software

Answer

An insurance policy covering software vulnerabilities and zero-day exploits

Question 5

What contractual provision governs how a vendor handles client data after contract termination?

Accepted Answer

Data return and destruction clause

Answer

Non-compete clause

Answer

Automatic renewal clause

Answer

Arbitration clause

Question 6

Which regulatory framework most directly impacts vendor contract requirements for companies handling payment card data?

Accepted Answer

PCI DSS

Answer

HIPAA

Answer

FERPA

Answer

COPPA

Question 7

What is the purpose of a 'penetration testing clause' in a vendor contract?

Accepted Answer

To grant the client the right to conduct or commission security testing of the vendor's systems

Answer

To allow the vendor to test the client's internal systems without prior notice

Answer

To prohibit any security testing of vendor-managed systems

Answer

To require the vendor to test the client's employees for security awareness