Which two common security frameworks are used today to assess and validate a vendor's security practices? (Choose two.)

ISO 27001 and the NIST Cybersecurity Framework (CSF) are foundational frameworks for assessing and validating a vendor's security posture. ISO 27001 is an international standard that provides a specification for an Information Security Management System (ISMS). A vendor's certification against ISO 27001 offers formal, third-party attestation of their security practices. The NIST CSF provides a voluntary set of standards, guidelines, and best practices. It is widely used as a benchmark to structure vendor risk assessments and questionnaires, allowing an organization to measure a vendor's security maturity against a recognized, comprehensive framework covering the entire risk management lifecycle.

A. Data Science Council of America: This is a professional body for data science practitioners and is not a cybersecurity framework used for assessing vendor security practices.

B. Building Security in Maturity Model: BSIMM is a descriptive model focused specifically on software security initiatives and is not a comprehensive framework for assessing a vendor's overall information security program.

1. ISO/IEC 27001:2022: Information security

cybersecurity and privacy protection — Information security management systems — Requirements. Annex A

Controls A.5.19 ("Information security in supplier relationships")

A.5.20 ("Addressing information security within supplier agreements")

and A.5.21 ("Managing information security in the information and communication technology (ICT) supply chain") directly specify requirements for managing vendor security. Certification provides validation of these controls.

2. NIST Special Publication (SP) 800-161

Revision 1: Supply Chain Risk Management Practices for Federal Information Systems and Organizations. This document details how to manage supply chain risk and integrates concepts from the NIST Cybersecurity Framework. Section 2.3.2

"Relationship to Enterprise Risk Management

" discusses using frameworks like the CSF to manage risk across the enterprise

including the supply chain.

3. University of California

Berkeley

Information Security Office: Vendor Security Assessment. The university's official guidance for assessing third-party vendors states

"Acceptable evidence of a 3rd party assessment includes... an ISO 27001 certification" and provides questionnaires mapped to NIST standards. This demonstrates the use of both frameworks in a real-world

academic setting for vendor validation. (See: security.berkeley.edu/resources/vendor-security-assessment).