CompTIA CASP+ Practice Test

Where is the best place to document security responsibilities when outsourcing?

1. Contract

2. SLAs

3. Internal policy documents

4. Vendor application forms

The correct answer is: SLAs

Documenting security responsibilities when outsourcing is best done in SLAs, or Service Level Agreements. SLAs are formal contracts that define the levels of service expected from a service provider and often include key performance indicators (KPIs) and specific security responsibilities. This makes SLAs crucial for establishing clear obligations, expectations, and accountability regarding security measures. By including security responsibilities in SLAs, organizations can ensure there is a mutual understanding and agreement on how security will be maintained, what standards will be upheld, and what procedures will be followed in case of a security incident. This helps to create a legally binding framework that can guide the relationship and provide recourse if security obligations are not met. While contracts also cover various aspects of the outsourcing agreement, SLAs typically focus specifically on performance metrics and security responsibilities, making them the more appropriate choice for this context. Internal policy documents and vendor application forms serve different purposes; internal policies guide how an organization implements security overall, while vendor application forms primarily gather information about potential vendors rather than specifying contractual obligations related to security.