2 cissp ® Official Study Guide Eighth Edition

60
Chapter 2 
■
Personnel Security and Risk Management Concepts
Vendor, Consultant, and Contractor
Agreements and Controls
Vendor, consultant, and contractor controls are used to define the levels of performance, 
expectation, compensation, and consequences for entities, persons, or organizations that 
are external to the primary organization. Often these controls are defined in a document or 
policy known as a 
service-level agreement (SLA)
.
Using SLAs is an increasingly popular way to ensure that organizations providing ser-
vices to internal and/or external customers maintain an appropriate level of service agreed 
on by both the service provider and the vendor. It’s a wise move to put SLAs in place for 
any data circuits, applications, information processing systems, databases, or other critical 
components that are vital to your organization’s continued viability. SLAs are important 
when using any type of third-party service provider, which would include cloud services. 
The following issues are commonly addressed in SLAs:
■
System uptime (as a percentage of overall operating time)
■
Maximum consecutive downtime (in seconds/minutes/and so on)
■
Peak load
■
Average load
■
Responsibility for diagnostics
■
Failover time (if redundancy is in place)
SLAs also commonly include financial and other contractual remedies that kick in if the 
agreement is not maintained. For example, if a critical circuit is down for more than 15 
minutes, the service provider might agree to waive all charges on that circuit for one week.
SLAs and vendor, consultant, and contractor controls are an important part of risk 
reduction and risk avoidance. By clearly defining the expectations and penalties for exter-
nal parties, everyone involved knows what is expected of them and what the consequences 
are in the event of a failure to meet those expectations. Although it may be very cost effec-
tive to use outside providers for a variety of business functions or services, it does increase 
potential risk by expanding the potential attack surface and range of vulnerabilities. SLAs 
should include a focus on protecting and improving security in addition to ensuring quality 
and timely services at a reasonable price. Some SLAs are set and cannot be adjusted, while 
with others you may have significant influence over their content. You should ensure that 
an SLA supports the tenets of your security policy and infrastructure rather than being in 
conflict with it, which could introduce weak points, vulnerabilities, or exceptions.