A vendor contract promises 'bank-grade encryption' but the city also has a state records law. How should the security manager treat these drivers?
Select an answer to reveal the explanation.
Short Explanation
A glossy contract line about 'bank-grade encryption' is one promise. A state records law is another obligation entirely. Hitting the brochure wording does not magically clear the statute — you have to satisfy each driver on its own terms.
Full Explanation
Security obligations arrive from multiple independent drivers: contracts, statutes, and regulatory or industry mandates. A vendor promise of 'bank-grade encryption' does not extinguish a state records law, and satisfying a statute does not automatically meet every contractual clause. The security manager must treat these as separate constraints and verify compliance against each—meeting one never proves the others are done.
Honoring only the marketing phrase while ignoring statutes elevates brochure language over binding law. Treating the state records law as optional once a contract is signed reverses legal priority; private agreements cannot waive public legal duties. Replacing all drivers with an informal email from a vendor account manager abandons both contract discipline and statutory compliance for undocumented assurance.
Exam caveat: Multi-driver stems want recognition that contract ≠ law ≠ regulation. Pick the option that keeps them distinct and concurrently binding.
Operational check: Maintain a requirements register listing contractual security clauses, applicable records statutes, and any industry mandates; map each to controls and evidence; and reject vendor marketing language as a substitute for verifiable requirements.