The project sign-off is the formal acceptance of the project deliverables by the client, stakeholder, or customer. It also marks the closure of the project and the release of the final payment. If the project sign-off is not completed, the project may still incur costs and liabilities, which can explain the losses in the financial report. Therefore, the project manager should complete the project sign-off as soon as possible to avoid further losses12.

When a project team lacks hands-on experience and decides to involve a third-party vendor for product development, the first document to expedite is a Request for Proposal (RFP). An RFP outlines the project requirements and asks potential vendors to submit proposals detailing how they would meet those requirements and at what cost. This allows the project manager to evaluate the capabilities and offerings of different vendors before making a decision.
Reference = CompTIA Project+ Certification Study Guide (PK0-005)

The project manager should put in place a time and materials contract before work begins for a third party that needs to perform a short-term task for which the duration cannot be accurately estimated and the cost cannot be calculated in advance. A time and materials contract is a type of contract where the buyer pays the seller based on the actual time spent and materials used during the project. A time and materials contract is suitable for projects that have uncertain or variable scope, duration, or cost. A time and materials contract can provide flexibility and adaptability for both parties and allow them to adjust to changing requirements or circumstances.

Operational security (OPSEC) is a process that prevents sensitive information from getting into the wrong
hands by viewing operations from the perspective of an adversary1. Facility access is a form of OPSEC that
controls who can enter and exit a physical location where sensitive data or equipment is stored or processed.
Facility access can include measures such as locks, alarms, badges, biometrics, guards, and cameras. The other
options are not correct because:
Mobile device compliance is a policy that ensures that mobile devices used by employees or contractors
meet certain security standards and requirements, such as encryption, password protection, antivirus,
and remote wipe. Mobile device compliance is not a form of OPSEC, but rather a form of data security
or device management.
Background screening is a process that checks the criminal, financial, and employment history of a
potential employee or contractor before hiring them. Background screening is not a form of OPSEC, but
rather a form of human resource management or risk mitigation.
Multifactor authentication is a method that requires users to provide two or more pieces of evidence to
verify their identity before accessing a system or service, such as a password, a code, a token, or a
biometric. Multifactor authentication is not a form of OPSEC, but rather a form of access control or
identity management. References = CompTIA Project+ Study Guide: Exam PK0-005, 3rd Edition,
Chapter 10: Executing and Closing Projects, page 314; CompTIA Project+ Certification Exam
Objectives, Domain 3: Project Execution, Objective 3.2: Given a scenario, execute and monitor project
tasks using traditional methodologies; What is Operational Security? The Five-Step Process, Best
Practices, and More