A critical public-alert vendor offers no security SLA and no contractual right to audit. What SCRM gap does this represent?
Select an answer to reveal the explanation.
Short Explanation
If the alert vendor won't promise security terms or let you look under the hood, you're flying blind on a life-safety pipe. SLAs and audit rights are how cities set the floor. No floor, no SCRM.
Full Explanation
A critical public-alert vendor that offers no security SLA and no contractual right to audit presents a clear SCRM gap: missing service-level and minimum security requirements that critical providers should meet. Public alerts affect life safety and emergency communications; without SLAs and audit rights, the city cannot verify availability, incident handling, or control posture when it matters most. Framing the gap as excessive customer control, inherent vendor trustworthiness, or a problem solvable only by buying more firewalls on the customer edge misdiagnoses the contractual assurance deficit. Firewalls do not replace the need for provider commitments on security and transparency. Exam caveat: CISSP supply-chain and third-party management emphasize minimum security requirements and measurable obligations for critical services. Operational check: renegotiate or replace the vendor to include security SLAs, incident notification timelines, audit or assessment rights, and continuity commitments; document residual risk if leadership accepts a weak contract temporarily. Tier vendors by criticality so public-alert and similar life-safety providers receive the strictest contractual bar. Track SLA breaches and assessment findings into the risk register with named owners.