A.Integrate risk management into the vendor management process.

B.Perform an audit on vendors' security controls and practices.

C.Review third-party contracts as part of the vendor management process.

D.Conduct security reviews on the services and solutions delivered.

A.Risk assessments must be conducted by certified staff.

B.The methodology must be approved by the chief executive officer.

C.Risk assessments must be reviewed annually.

D.The methodology used must be consistent across the organization.

A.status of the security posture

B.probability of future incidents

C.cost-benefit of security controls

D.risk acceptance criteria

A.The number of reported security events

B.Quiz scores for users who took security awareness classes

C.User approval rating of security awareness classes

D.Percentage of users who have taken the courses

A.Update the application security policy.

B.Implement compensating control.

C.Submit a waiver for the legacy application.

D.Perform an application security assessment.