Câu 165: Isaca Certified Information Security Manager

A newly appointed information security manager of a retailer with multiple stores discovers an HVAC (heating, ventilation, and air conditioning) vendor has remote access to the stores to enable real-time monitoring and equipment diagnostics. Which of the following should be the information security manager's FIRST course of action?

1. A. Disconnect the real-time access.
2. B. Conduct a penetration test of the vendor.
3. C. Review the vendor contract. — đáp án hiện tại
4. D. Review the vendor's technical security controls.