Ensuring Compliance of Third-Party Contract Programmers with Security Policies | CISA Exam

A.

The BEST assurance that the third party's contract programmers comply with the organization's security policies is provided by option D: Require annual signed agreements of adherence to security policies.

Explanation:

A. Perform periodic security assessments of the contractors' activities. Performing periodic security assessments of the contractors' activities can provide some assurance that the contractors comply with the organization's security policies. However, it may not be the BEST assurance since it can be resource-intensive and may not necessarily capture all non-compliant activities.

B. Conduct periodic vulnerability scans of the application. Conducting periodic vulnerability scans of the application can help identify vulnerabilities and security weaknesses in the application developed by the third party. However, it may not be the BEST assurance that the third party's contract programmers comply with the organization's security policies since it does not ensure that the programmers are following security policies while developing the application.

C. Include penalties for noncompliance in the contracting agreement. Including penalties for noncompliance in the contracting agreement can provide some deterrence against noncompliance with security policies. However, it may not be the BEST assurance since it does not ensure that the third party's contract programmers are following the security policies while developing the application.

D. Require annual signed agreements of adherence to security policies. Requiring annual signed agreements of adherence to security policies from the third party's contract programmers is the BEST assurance that the third party's contract programmers comply with the organization's security policies. It ensures that the third party's contract programmers are aware of the security policies and agree to comply with them while developing the application. Annual signing of agreements ensures continued commitment to following security policies.

In conclusion, while all the options may provide some level of assurance, the BEST assurance that the third party's contract programmers comply with the organization's security policies is provided by requiring annual signed agreements of adherence to security policies.