CSL Cybersecurity Contract Law & Vendor Management 3

Question 1

How does cyber insurance typically interact with vendor contract requirements?

Accepted Answer

Vendor contracts often require vendors to carry specified cyber insurance coverage and name clients as additional insureds

Answer

Vendor contracts commonly require vendors to maintain specified cyber insurance coverage levels and may require that clients be named as additional insureds, ensuring coverage extends to client losses caused by vendor incidents.

Question 2

Under the concept of 'vicarious liability,' when might a company be held responsible for a vendor's cybersecurity negligence?

Accepted Answer

When the company has sufficient control over the vendor's operations or the vendor acts as the company's agent

Answer

Vicarious liability may attach when a company exercises sufficient control over a vendor's activities or the vendor functions as an agent, potentially making the company responsible for vendor negligence.

Question 3

What is a security assessment questionnaire (SAQ) used for in vendor management?

Accepted Answer

To evaluate a vendor's security posture before and during a contractual relationship

Answer

An SAQ is used to gather information about a vendor's security controls, policies, and practices to assess risk and ensure alignment with contractual security requirements prior to and throughout the relationship.

Question 4

What does 'source code escrow' refer to in software vendor contracts with security implications?

Accepted Answer

A neutral third-party arrangement where source code is deposited for client access if the vendor goes out of business

Answer

Software escrow involves depositing source code with a neutral third party so the client can access it if the vendor becomes insolvent or fails to maintain the software, protecting business continuity.

Question 5

What contractual provision governs how a vendor handles client data after contract termination?

Accepted Answer

Data return and destruction clause

Answer

A data return and destruction clause specifies that at contract end, the vendor must return, delete, or destroy client data and provide written certification of destruction.

(CSL) Cybersecurity Law Certification Practice Test

(CSL) Cybersecurity Law Certification Practice Test

CSL Cybersecurity Contract Law & Vendor Management 3