CSM Vendor Management & Procurement Flashcards
6 cards from real CSM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 CSM Vendor Management & Procurement flashcards as text
What is the purpose of a 'right to audit' clause in a software vendor contract?
Answer: It grants the client the right to inspect the vendor's records to verify compliance with contract terms
A right-to-audit clause gives the client contractual authority to examine the vendor's records, processes, and controls to verify that contractual, regulatory, and security obligations are being met.
In software outsourcing, what is a Statement of Work (SOW)?
Answer: A detailed document specifying deliverables, timelines, acceptance criteria, and responsibilities for a specific project
An SOW defines precisely what work will be done, what will be delivered, when, and how quality will be measured, forming the technical foundation of an outsourcing contract.
A software manager is evaluating two vendors with similar capabilities. Vendor A is 20% cheaper but has no US data center presence. Vendor B has US data centers but costs more. For a US healthcare application, which factor should tip the decision toward Vendor B?
Answer: HIPAA compliance requirements that mandate data residency controls
HIPAA requires covered entities to ensure that PHI is protected with appropriate safeguards, and data residency within the US with a Business Associate Agreement (BAA) is typically necessary.
What is the key purpose of conducting a vendor risk assessment before signing a software contract?
Answer: To identify potential risks (financial, security, operational) the vendor poses to the organization
A vendor risk assessment identifies and evaluates threats from the vendor relationship—such as data breach risk, business continuity risk, and regulatory exposure—before commitment.
Which procurement document is typically released BEFORE an RFP when an organization wants to gauge market interest and gather preliminary capability information?
Answer: Request for Information (RFI)
An RFI is issued early in the procurement process to gather general market information and vendor capabilities before defining detailed requirements for a formal RFP.
In vendor contract negotiations, what is an 'escrow agreement' for software source code?
Answer: An arrangement where source code is held by a neutral third party and released to the client if the vendor fails
A source code escrow agreement protects the client by having a third party hold the vendor's source code, releasing it to the client if the vendor goes bankrupt or ceases to support the product.