5.3 - CompTIA Security+

Penetration testing

A simulated cyber attack against an organization's systems or networks to identify vulnerabilities that could be exploited by attackers.

Right-to-audit clause

A contractual provision that grants an organization the authority to conduct audits or assessments of vendor operational practices, information systems, and security controls.

Evidence of internal audits

Evidence that the vendor has internal audit practices, which provide an independent and objective evaluation of internal controls and risk management practices.

Independent assessments

Engaging with independent experts to evaluate and verify vendor capabilities, security, and compliance practices.

Supply chain analysis

Evaluating the security posture and risk management practices of all entities involved in the production and delivery of goods.

Due diligence

A legal principle that a subject has used best practice or reasonable care when setting up, configuring, and maintaining a system, or investigating vendors.

Conflict of interest

Occurs when an individual or organization has competing interests or obligations that could compromise their ability to act objectively or impartially.

Service-level agreement (SLA)

A legally binding agreement that sets the service requirements and expectations between a consumer and a provider.

Memorandum of agreement (MOA)

A legal document forming the basis for two parties to cooperate without a formal contract, which can be legally binding depending on terms.

Memorandum of understanding (MOU)

A nonbinding agreement outlining intentions, shared goals, and general terms of cooperation between parties.

Master service agreement (MSA)

A legally binding contract that establishes precedence and guidelines for any business documents executed between two parties.

Work order (WO)/statement of work (SOW)

A legally binding document that defines the expectations, scope, and deliverables for a specific business arrangement.

Non-disclosure agreement (NDA)

A legally binding document that ensures the confidentiality and protection of sensitive information shared during the relationship.

Business partners agreement (BPA)

An agreement by two companies to work together closely, such as partner agreements between large IT companies and resellers.

Vendor monitoring

The process of continuously overseeing and evaluating vendors to ensure adherence to security standards and compliance requirements.

Questionnaires

Structured means of obtaining consistent information in vendor management, enabling more effective risk analysis and comparison.

Rules of Engagement (RoE)

A definition of how a pen test will be executed, providing guidelines for the pen tester regarding permissions and constraints.