A city is selecting a court e-filing SaaS provider. Which SCRM mitigation set best fits the procurement security requirements?
Select an answer to reveal the explanation.
Short Explanation
For court e-filing, trust but verify with real SCRM levers: assessments, written minimums, and SBOMs when they fit. Glossy PDFs are not assurance. Put the expectations in the deal before go-live.
Full Explanation
Selecting a court e-filing SaaS provider should include SCRM mitigations such as third-party security assessments, contractual minimum security requirements, and software bills of materials where applicable. Court filings often contain sensitive personal and case data; marketing brochures alone do not demonstrate control effectiveness. Prohibiting logging to avoid forensic trails weakens detection and legal hold capabilities. Hosting court data exclusively on employee laptops contradicts enterprise SaaS control expectations and increases loss and disclosure risk. Contractual rights, assessment artifacts, and transparency into components help the municipality evaluate and monitor provider risk throughout the relationship. Exam caveat: CISSP SCRM expects due diligence and contractual security for critical third parties—not brochure-level assurance. Operational check: require SOC reports or equivalent assessments, define security SLAs and audit rights, demand SBOM or component transparency for relevant software, and map vendor controls to the city's data classification for court records. Include exit and data-return clauses, and calendar reassessment dates so assurance does not expire silently after award.