CompTIA CASP+ Practice Test

What is the recommended action for Company B's IT staff to address security impacts after purchasing a third-party product?

1. Implement a new email system

2. Use Company A's change management process

3. Conduct a hardware audit

4. Upgrade their existing software

The correct answer is: Use Company A's change management process

The recommended action for Company B's IT staff to address the security impacts after purchasing a third-party product is to use Company A's change management process. This approach is critical for several reasons. When a third-party product is acquired, it brings with it potential vulnerabilities and risks that can impact the overall security posture of the organization. A change management process helps ensure that all modifications to the IT environment are documented, assessed for risks, and evaluated for their impact on existing systems and infrastructure. This systematic approach facilitates the identification and mitigation of security risks associated with the new product. Utilizing an established change management process from another company, in this case, Company A, likely means that the process is tried-and-tested and adheres to best practices. This can provide a structured framework within which the IT staff can operate, ensuring that all stakeholders are involved, risks are assessed thoroughly, and necessary security controls are implemented before, during, and after the integration of the third-party product. Other actions such as implementing a new email system or conducting a hardware audit may not directly address the security risks introduced by the acquisition of a new product. Similarly, while upgrading existing software could be beneficial, it does not specifically relate to managing the changes that come with integrating the newly purchased third