Question

An information security manager is asked to support a business unit issuing a request for proposal (RFP) for a new managed application service that will process customer personal data. The business wants to move quickly and has already shortlisted three vendors based primarily on price and features. What is the BEST way for the security manager to influence the selection?

Accepted Answer

Define weighted security evaluation criteria and require vendor responses to a security questionnaire before final scoring

Answer

Wait until a preferred vendor is chosen, then negotiate security clauses into the contract

Answer

Perform a penetration test against each shortlisted vendor's production environment

Answer

Require all three vendors to hold a specific security certification as a mandatory pass/fail gate