ISP Supply Chain Security & Vendor Management 2

Question 1

Which of the following is the BEST method for evaluating a new vendor's security posture before awarding a contract?

Accepted Answer

Conducting a third-party security audit or requiring completion of a standardized security questionnaire

Answer

Third-party audits or standardized questionnaires (such as NIST SP 800-161 aligned assessments) provide objective, verifiable evidence of a vendor's security controls.

Question 2

Under NIST SP 800-161, what is the primary purpose of a Supplier Risk Assessment?

Accepted Answer

To identify, assess, and mitigate cybersecurity and supply chain risks posed by ICT suppliers

Answer

NIST SP 800-161 specifically guides organizations in identifying, assessing, and mitigating risks that information and communications technology (ICT) suppliers introduce into the supply chain.

Question 3

A critical industrial facility learns that its SCADA software vendor will reach end-of-life (EOL) in six months with no patches thereafter. What is the MOST appropriate response?

Accepted Answer

Develop a migration plan to supported software while implementing compensating controls during transition

Answer

A structured migration plan with compensating controls (such as enhanced monitoring and network segmentation) addresses the risk while maintaining operational continuity during the transition.

Question 4

Which clause in a vendor contract BEST helps protect an organization if a supplier experiences a security incident?

Accepted Answer

Security breach notification requirement clause

Answer

A security breach notification requirement obligates the vendor to promptly inform the organization of incidents, enabling timely response and mitigation of downstream impacts.

Question 5

What is 'supply chain transparency' and why is it important for industrial security professionals?

Accepted Answer

The ability to trace components and services back to their origin to verify authenticity and integrity

Answer

Supply chain transparency enables organizations to verify where materials originate, detect tampering or counterfeiting, and ensure components meet security and quality standards.

(ISP) Industrial Security Professional Certification Practice Test

(ISP) Industrial Security Professional Certification Practice Test

ISP Supply Chain Security & Vendor Management 2