I85PREP
⌘ K
CSG study materials
CSG study resources

CSG practice questions

One question at a time. Build your CSG understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Governance

Which document is the primary, board-approved statement that defines an organization's overall security direction and intent?

  1. Baseline configuration standard
  2. Risk treatment plan
  3. Security operating procedure
  4. Information security policy Correct answer.

Explanation

The information security policy is the top-level, management-approved document that states the organization's security objectives and the principles governing how it protects information. Lower-level documents such as standards, procedures, and baselines derive their authority from, and must align with, this policy.

Question 2Security Governance

A security team establishes that a specific control must be implemented to satisfy a regulatory obligation that applies to the whole company. Which document type is most appropriate for mandating that requirement?

  1. A standard Correct answer.
  2. A project charter
  3. A guideline
  4. A service level agreement

Explanation

Standards are mandatory documents that specify the concrete requirements, such as a control that must be implemented, needed to comply with policy and external obligations. They are binding, unlike guidelines, which are advisory recommendations.

Question 3Security Governance

Who holds ultimate accountability for an organization's information security governance outcomes?

  1. The board of directors or equivalent governing body Correct answer.
  2. The external penetration testing vendor
  3. The security operations center manager
  4. The help desk supervisor

Explanation

Ultimate accountability for security governance rests with the board or equivalent governing body, which sets direction and oversees risk on behalf of stakeholders. Operational roles and vendors execute and advise, but they do not carry the governing accountability.

Question 4Security Governance

What distinguishes a security guideline from a security standard?

  1. A guideline is advisory and recommended, while a standard is mandatory Correct answer.
  2. A guideline applies externally, while a standard applies internally
  3. A guideline is technical, while a standard is administrative
  4. A guideline is approved by the board, while a standard is approved by staff

Explanation

Guidelines offer recommended practices and flexibility in how to meet requirements, whereas standards are mandatory and define specific, enforceable requirements. The distinction is about obligation, not about approval level or technical versus administrative content.

Question 5Security Governance

A governance framework requires that duties be separated so that the person who approves a change cannot also deploy it without review. Which principle does this illustrate?

  1. Need to know
  2. Defense in depth
  3. Separation of duties Correct answer.
  4. Least privilege

Explanation

Separation of duties divides critical functions among different people so that no single individual can complete a sensitive action alone, reducing the risk of error or fraud. Least privilege, in contrast, limits the permissions each person holds rather than splitting functions.

Question 6Security Governance

In security governance, what is the primary purpose of a risk appetite statement?

  1. To list every risk identified in the risk register with its owner
  2. To define the technical configuration of security controls
  3. To express the amount and type of risk the organization is willing to accept in pursuit of its objectives Correct answer.
  4. To record incidents that have already occurred

Explanation

A risk appetite statement articulates how much risk, and of what kinds, the organization is prepared to accept in pursuing its goals, guiding decision-making and treatment choices. It is a directional statement rather than a catalog of individual risks or a technical specification.

Question 7Security Governance

Which term describes the acceptable level of variation from a security requirement that management is willing to tolerate before escalation is required?

  1. Risk transfer
  2. Risk tolerance Correct answer.
  3. Risk avoidance
  4. Residual risk

Explanation

Risk tolerance defines the acceptable range of deviation from requirements or the level of risk exposure management will permit before action or escalation is triggered. It operationalizes the broader risk appetite at a more granular level.

Question 8Security Governance

What is the main purpose of an information security steering committee?

  1. To approve individual employee leave requests
  2. To conduct hands-on penetration testing of applications
  3. To provide cross-functional oversight and direction for security strategy and investment decisions Correct answer.
  4. To perform daily log monitoring and alert triage

Explanation

A steering committee brings together senior stakeholders from across the organization to set direction, prioritize security initiatives, and oversee investment and risk decisions. It is a governance body, not an operational or administrative function.

Question 9Security Governance

An organization wants to compare its security program against a recognized set of governance and management practices to identify gaps. Which activity best fits this goal?

  1. Running a vulnerability scan of the external network
  2. Conducting a maturity assessment against a framework such as ISO/IEC 27001 or COBIT Correct answer.
  3. Testing backup restoration for a single database
  4. Reviewing firewall rules for redundant entries

Explanation

A maturity assessment measures the security program against an established framework of governance and management practices, revealing gaps and improvement priorities. Technical activities like scanning or rule review address specific controls rather than overall program maturity.

Question 10Security Governance

A company decides to purchase cyber insurance to cover potential financial losses from incidents. Which risk treatment option does this represent?

  1. Risk avoidance
  2. Risk mitigation
  3. Risk acceptance
  4. Risk transfer Correct answer.

Explanation

Buying insurance transfers a portion of the financial consequence of risk to a third party, which is the defining characteristic of risk transfer. Mitigation reduces likelihood or impact directly, avoidance removes the activity, and acceptance retains the risk without such action.

Question 11Security Governance

A third-party supplier will process regulated customer data. Which governance artifact best establishes the security obligations the supplier must meet?

  1. A network diagram of the supplier's data center
  2. A marketing brochure describing the supplier's services
  3. A contractual agreement incorporating specific security and data protection requirements Correct answer.
  4. An internal acceptable use policy for employees

Explanation

Contractual agreements that embed explicit security and data protection obligations create enforceable requirements the supplier must satisfy and give the organization a basis for oversight and remedies. Internal policies govern employees, while diagrams and brochures carry no binding obligations.

Question 12Security Governance

During due diligence, a governance team must decide how deeply to assess a low-risk supplier of office supplies versus a high-risk cloud provider hosting production data. Which approach is most appropriate?

  1. Assess only the office supplier because it is easier to audit
  2. Apply risk-tiered due diligence, with deeper assessment for the higher-risk provider Correct answer.
  3. Skip assessment for both because suppliers are external parties
  4. Apply identical deep assessments to both suppliers regardless of risk

Explanation

Risk-tiered due diligence scales the depth of assessment to the risk a supplier presents, concentrating effort on providers with greater access to sensitive data or critical operations. Uniform deep assessment wastes resources, while skipping or misdirecting assessment leaves material risk unmanaged.

Question 13Security Governance

What is the primary governance purpose of an exception (waiver) process for security requirements?

  1. To permanently remove requirements that are inconvenient
  2. To document, risk-assess, and formally approve deviations with a defined expiry and compensating controls Correct answer.
  3. To allow employees to bypass any control without documentation
  4. To transfer accountability for the deviation to the auditor

Explanation

An exception process provides a controlled, documented route for approving deviations after risk assessment, typically requiring compensating controls, an accountable approver, and an expiry date for review. This preserves governance visibility rather than creating uncontrolled bypasses.

Question 14Security Governance

A risk register entry shows a high likelihood and high impact risk with no owner assigned. What is the most significant governance deficiency?

  1. The risk was documented at all rather than left informal
  2. The risk has been assessed with two dimensions instead of one
  3. The risk lacks accountability, so treatment and monitoring are unlikely to be driven Correct answer.
  4. The risk register has too many fields populated

Explanation

Assigning an owner is fundamental to risk governance because owners are accountable for selecting, funding, and monitoring treatment. Without ownership, even a well-assessed risk tends to stall without action or oversight.

Question 15Security Governance

Which metric best demonstrates to leadership that security governance is functioning rather than merely that controls exist?

  1. Count of security tools deployed across the estate
  2. Total number of firewall rules configured
  3. Number of pages in the security policy document
  4. Percentage of identified risks with approved treatment plans and current review dates Correct answer.

Explanation

Governance effectiveness is shown by whether risks are being actively managed, evidenced by approved treatment plans and timely reviews. Counting tools, rules, or policy pages reflects activity or volume, not whether decisions and oversight are working.

Question 16Security Governance

An auditor finds that a policy was approved three years ago and has never been reviewed despite significant organizational change. Which governance principle is most directly violated?

  1. Policies must be written by external consultants
  2. Policies must be reviewed and updated at planned intervals or upon significant change Correct answer.
  3. Policies must be kept confidential from all employees
  4. Policies must be shorter than five pages

Explanation

Governance requires that policies be reviewed at planned intervals and when significant changes occur so they remain relevant and effective. Stale policies can misdirect behavior and fail to reflect the current risk environment or organizational structure.

Question 17Security Governance

A new regulation requires the organization to retain security logs for a longer period. Which governance action should occur first?

  1. Perform a compliance gap assessment and assign ownership for remediation Correct answer.
  2. Immediately purchase additional storage without further analysis
  3. Announce the change to customers before internal planning
  4. Delete existing logs to start fresh under the new rule

Explanation

When a new obligation arises, governance calls first for a gap assessment to understand the delta between current practice and the requirement, followed by assigned ownership and a remediation plan. Buying storage or deleting logs without analysis may be wasteful or harmful, and external communication should follow internal planning.

Question 18Security Governance

Which statement best describes the relationship between governance and management in security?

  1. Governance is optional, while management is mandatory
  2. Governance performs daily operations, while management sets strategy
  3. Governance and management are identical functions performed by the same team
  4. Governance sets direction and oversight, while management executes activities to achieve that direction Correct answer.

Explanation

Governance establishes direction, priorities, and oversight through accountable bodies, while management plans and executes the activities that realize that direction. Confusing the two leads to either strategy without execution or operations without accountability.

Question 19Security Governance

A business unit wants to adopt a cloud service that stores confidential data. Which governance check should be completed before approval?

  1. A review of the vendor's stock price trend
  2. A count of the vendor's social media followers
  3. A survey of employee preferences for the service
  4. A risk assessment confirming the service meets security requirements and that residual risk is within appetite Correct answer.

Explanation

Adoption decisions should be grounded in a risk assessment that verifies the service satisfies security requirements and that any residual risk falls within the organization's appetite. Irrelevant commercial or popularity indicators do not address security exposure.

Question 20Security Governance

Which practice best supports the principle of least privilege at a governance level?

  1. Removing access reviews to reduce administrative overhead
  2. Requiring periodic access reviews with documented approval by resource owners Correct answer.
  3. Allowing users to self-assign roles as needed
  4. Granting administrators permanent broad access to avoid delays

Explanation

Periodic access reviews with resource-owner approval ensure that entitlements remain justified and are removed when no longer needed, which operationalizes least privilege. Permanent broad access, self-assignment, and eliminating reviews all erode the principle.

Question 21Security Governance

An organization must demonstrate that it has systematically identified the legal, regulatory, and contractual security obligations that apply to it. Which governance activity directly satisfies this need?

  1. Publishing an annual security awareness newsletter
  2. Scheduling quarterly penetration tests
  3. Maintaining a compliance obligations register mapped to controls Correct answer.
  4. Renewing the antivirus subscription on time

Explanation

A compliance obligations register identifies applicable legal, regulatory, and contractual requirements and maps them to the controls that satisfy them, providing traceable evidence of systematic identification. Awareness, licensing, and testing activities do not by themselves catalog obligations.

Question 22Security Governance

Two business units interpret the same security policy differently, producing inconsistent control implementation. Which governance response most directly addresses the root cause?

  1. Delegate all interpretation to individual employees
  2. Withdraw the policy to eliminate the ambiguity
  3. Sanction both units for noncompliance without further guidance
  4. Issue clarifying standards that translate the policy into specific, consistent requirements Correct answer.

Explanation

Inconsistent interpretation usually signals that the policy is too abstract, so developing standards that specify concrete requirements restores consistency while preserving policy intent. Punishment or withdrawal does not resolve ambiguity and can weaken governance.

Question 23Security Governance

A risk owner proposes accepting a high-impact risk without compensating controls because treatment is expensive. What should governance require before acceptance is approved?

  1. Approval by the risk owner alone with no review
  2. Deferral of the decision indefinitely
  3. Silent acceptance so the decision is not recorded
  4. Documented justification, comparison against risk appetite, and formal sign-off at an authority level commensurate with the exposure Correct answer.

Explanation

Accepting significant risk demands documented rationale, an explicit comparison against the organization's appetite, and approval by an authority level appropriate to the exposure. This ensures the decision is transparent, accountable, and subject to oversight.

Question 24Security Governance

An internal audit finds that security exceptions are routinely granted verbally and never expire. Which combination of governance weaknesses does this most clearly indicate?

  1. Insufficient security awareness training and weak onboarding
  2. Poor network segmentation and missing patch management
  3. Excessive reliance on encryption and weak password complexity
  4. Inadequate exception documentation and absent time-bound review of accepted risk Correct answer.

Explanation

Verbal, non-expiring exceptions indicate both a documentation failure and the absence of periodic review that keeps accepted risk time-bound and visible. Technical control gaps such as segmentation or patching are separate issues not evidenced by the finding.

Question 25Security Governance

A multinational firm must satisfy conflicting data protection requirements across jurisdictions. Which governance approach is most defensible?

  1. Apply the least stringent requirement everywhere to minimize cost
  2. Ignore jurisdictions where enforcement is perceived as weak
  3. Map each jurisdiction's requirements, identify conflicts, and adopt controls meeting the strictest applicable obligation where feasible Correct answer.
  4. Apply requirements inconsistently based on which team is responsible

Explanation

Mapping requirements per jurisdiction and adopting controls that satisfy the strictest applicable obligation where feasible reconciles conflicts while maintaining compliance. Choosing the weakest standard or ignoring enforcement exposes the organization to legal and reputational risk.

Question 26Security Governance

Which document typically sits at the top of an information security policy hierarchy and states management's overall commitment to protecting information?

  1. The incident response runbook
  2. The firewall configuration standard
  3. The vulnerability scan report
  4. The enterprise information security policy Correct answer.

Explanation

An enterprise-level security policy is a high-level statement of management intent that authorizes and frames all lower-level standards, procedures, and guidelines. Standards, procedures, and records derive their authority from it and must remain consistent with it.

Question 27Security Governance

A security manager needs to define who may approve access to a payroll system and under what conditions. Which type of document is most appropriate?

  1. A policy Correct answer.
  2. A standard
  3. A guideline
  4. A procedure

Explanation

Policies establish mandatory high-level rules, including decision rights such as who may grant access to a sensitive system. Standards, procedures, and guidelines elaborate on how those rules are met but do not themselves define authority.

Question 28Security Governance

What distinguishes a security standard from a security guideline?

  1. Standards are optional; guidelines are mandatory
  2. Standards are mandatory and measurable; guidelines are recommended advice Correct answer.
  3. Standards apply only to IT staff; guidelines apply to all staff
  4. Standards are approved by auditors; guidelines are approved by management

Explanation

Standards contain mandatory, often measurable requirements that must be met, while guidelines provide recommended practices that allow discretion. Both can apply organization-wide and both are normally approved through the same governance process.

Question 29Security Governance

Which role is accountable for ensuring that a specific identified risk is treated and monitored?

  1. The risk owner Correct answer.
  2. The internal auditor
  3. The service desk analyst
  4. The data subject

Explanation

A risk owner is the individual with authority and accountability for managing a given risk, including selecting and overseeing treatment and monitoring residual exposure. Assigning ownership converts a register entry into an actionable governance item.

Question 30Security Governance

What is the primary function of a security awareness and training program within governance?

  1. To satisfy auditors without changing behavior
  2. To replace technical controls where budget is limited
  3. To reduce human-related risk by ensuring staff understand their security responsibilities Correct answer.
  4. To transfer accountability for security failures to employees

Explanation

Awareness and training programs communicate policies and expected behaviors so that personnel can fulfill their assigned security responsibilities, reducing human-related risk. Accountability for risk remains with management and designated owners, not with the workforce at large.

Question 31Security Governance

Which element is essential to make a security policy enforceable?

  1. It is kept confidential from all employees
  2. It is approved by senior management and communicated to those it binds Correct answer.
  3. It is written by the security team without review
  4. It is published on the intranet only

Explanation

A policy gains authority when senior management approves it and it is communicated to the population it governs, enabling consistent enforcement and accountability. Without formal approval and communication, enforcement is difficult to justify.

Question 32Security Governance

In governance terms, what does segregation of duties aim to prevent?

  1. One person having enough authority to both commit and conceal an error or fraud Correct answer.
  2. Use of shared service accounts
  3. Deployment of redundant systems
  4. Excessive documentation of controls

Explanation

Segregation of duties divides critical tasks so that no single individual can initiate, approve, and record a sensitive transaction without independent oversight. This reduces the chance that errors or fraudulent acts go undetected.

Question 33Security Governance

What is the purpose of a security governance charter?

  1. To record individual user login activity
  2. To provide end-user instructions for configuring devices
  3. To define the committee's mandate, membership, and decision authority Correct answer.
  4. To list every vulnerability found in the environment

Explanation

A governance charter formally establishes a body's purpose, scope, membership, meeting cadence, and decision rights. It gives the group legitimate authority and a clear basis for accountability.

Question 34Security Governance

A regulator issues new guidance that applies to the organization's sector. Which governance step should occur first?

  1. Wait for the next annual policy review cycle
  2. Delegate the interpretation to a single business unit
  3. Immediately purchase new tooling for every business unit
  4. Assess the guidance against current obligations and assign an owner to determine impact Correct answer.

Explanation

New external requirements should be analyzed for applicability and impact, with a named owner coordinating the response, before commitments such as tool purchases are made. This ensures decisions are risk-based and consistent across the organization.

Question 35Security Governance

A control has been designed and documented but staff routinely bypass it under deadline pressure. What does this indicate about the control?

  1. The control is operating effectively
  2. The control should be removed from the framework
  3. The control has a design gap in its operating environment or enforcement Correct answer.
  4. The control's documentation is sufficient evidence of compliance

Explanation

A control that exists on paper but is routinely bypassed is not operating effectively, indicating a gap in enforcement, usability, or tone at the top. Governance should address why the control fails in practice rather than merely recording its existence.

Question 36Security Governance

Which approach best ensures that security requirements are built into a new system before it goes live?

  1. Rely on vendors to self-certify security
  2. Conduct a post-incident review after the first breach
  3. Add security testing only after deployment
  4. Integrate security review gates into the project lifecycle Correct answer.

Explanation

Embedding security review gates at defined project milestones ensures requirements are considered while changes are still inexpensive to make. This shifts security from after-the-fact remediation to planned governance.

Question 37Security Governance

An organization wants a repeatable way to decide which security investments to fund first. Which governance mechanism is most suitable?

  1. Selecting projects by the size of the requesting department
  2. A risk-based prioritization model tied to business impact Correct answer.
  3. Funding only initiatives proposed by the security team
  4. A first-come, first-served request queue

Explanation

Prioritizing investments by risk and business impact directs limited resources toward the exposures that matter most to the organization. A transparent model also supports defensible decisions and consistent treatment across business units.

Question 38Security Governance

What is the main governance value of defining key risk indicators for the security program?

  1. They provide early warning of changing risk exposure so management can act Correct answer.
  2. They replace the risk register
  3. They eliminate the need for control testing
  4. They guarantee that incidents will not occur

Explanation

Key risk indicators are forward-looking measures that signal when risk exposure is trending beyond tolerance, prompting timely management action. They complement control testing and the risk register rather than replacing them.

Question 39Security Governance

A business unit requests a policy exception that would expose regulated data. Who should make the final decision, and on what basis?

  1. The vendor hosting the data, based on its own terms
  2. A designated authority above the risk owner, based on documented risk acceptance criteria Correct answer.
  3. The requesting unit alone, based on its delivery schedule
  4. The service desk, based on ticket volume

Explanation

Exceptions that raise exposure above tolerance should be decided by an authority senior to the risk owner, applying documented acceptance criteria and recording the rationale. This preserves accountability and ensures decisions are consistent and auditable.

Question 40Security Governance

Which statement best describes the purpose of an asset inventory from a governance perspective?

  1. It is only needed for physical hardware
  2. It provides the basis for scoping controls, risk assessments, and accountability Correct answer.
  3. It is maintained solely by the finance department
  4. It replaces the need for access reviews

Explanation

A complete asset inventory defines what must be protected, enabling accurate scoping of controls, risk assessments, and assignment of ownership. Without it, governance decisions rest on an incomplete picture of the environment.

Question 41Security Governance

An organization's board asks how security spending compares with peers and whether it is proportionate to risk. Which governance activity best answers this?

  1. Reviewing individual firewall rules
  2. Benchmarking security maturity and spending against risk exposure and sector norms Correct answer.
  3. Counting the number of security alerts per day
  4. Auditing a single application's source code

Explanation

Benchmarking maturity and spend against risk exposure and sector norms gives leadership a proportionate view of investment. Operational details such as rule reviews or alert counts do not address the board's question about proportionality.

Question 42Security Governance

What is the primary purpose of a third-party risk tiering model?

  1. To ensure every supplier receives an identical assessment
  2. To reduce the number of suppliers to zero
  3. To allocate assessment depth in proportion to the risk a supplier presents Correct answer.
  4. To shift all liability to suppliers

Explanation

Tiering lets governance focus intensive due diligence on suppliers whose access, data, or criticality create the greatest risk, while applying lighter checks elsewhere. This makes oversight proportionate and sustainable.

Question 43Security Governance

A security team wants to demonstrate that access rights are appropriate over time. Which governance practice is most relevant?

  1. Continuous log retention
  2. Annual penetration testing
  3. Periodic access recertification by managers and asset owners Correct answer.
  4. Quarterly firewall rule cleanup

Explanation

Periodic recertification requires managers and asset owners to confirm that each user's access remains justified, catching entitlement creep. Other activities address different risks and do not verify access appropriateness.

Question 44Security Governance

Which factor most strongly justifies escalating a risk decision from a working group to executive leadership?

  1. The decision involves risk above the working group's delegated tolerance Correct answer.
  2. The decision affects a single non-critical workstation
  3. The decision requires technical configuration details
  4. The decision has already been made by the vendor

Explanation

Delegated authority has limits; when a decision would accept or create exposure beyond the working group's tolerance, it must be escalated to the level holding that authority. This keeps decision rights aligned with accountability.

Question 45Security Governance

An organization defines a target state for security maturity and a roadmap to reach it. Which governance artifact typically tracks progress against that target?

  1. A copy of the firewall ruleset
  2. An inventory of spare hardware
  3. A list of open help desk tickets
  4. A maturity roadmap with milestones and owners Correct answer.

Explanation

A maturity roadmap translates the target state into sequenced milestones with accountable owners, enabling leadership to track progress. Operational lists and technical artifacts do not convey strategic advancement toward the target.

Question 46Security Governance

A multinational organization must reconcile a global security policy with local legal requirements that differ by country. Which approach best reflects sound governance?

  1. Set a global baseline with documented local variances approved through governance Correct answer.
  2. Apply the strictest local rule everywhere without analysis
  3. Let each country set its own policy independently
  4. Suspend the global policy where local law is unclear

Explanation

A global baseline provides consistency, while a controlled variance process allows lawful local adaptation with documented approval. This balances enterprise coherence against jurisdictional obligations and keeps deviations visible.

Question 47Security Governance

Senior leadership repeatedly overrides security requirements to accelerate delivery, and staff observe no consequences. What is the most significant governance implication?

  1. Tone at the top is undermining the control environment and increasing risk Correct answer.
  2. The control framework is too complex and should be simplified
  3. The audit function is overstaffed
  4. The security team lacks sufficient technical tools

Explanation

When leadership routinely overrides requirements without accountability, it signals that controls are optional, eroding the control environment regardless of documented policy. Governance must address leadership behavior because it shapes how the whole organization treats risk.

Question 48Security Governance

An organization measures governance success only by the number of policies published. Why is this an inadequate governance metric?

  1. It measures output volume rather than whether risk is being reduced Correct answer.
  2. It conflicts with the principle of least privilege
  3. It is difficult for auditors to verify
  4. It requires too much data collection effort

Explanation

Counting published policies measures activity, not effectiveness; a large policy library can coexist with poor risk outcomes. Meaningful governance metrics should reflect whether controls operate and risk exposure is actually being managed.

Question 49Security Governance

Two subsidiaries apply different risk scoring scales, making enterprise aggregation unreliable. Which governance action best resolves this?

  1. Report only the subsidiary with the lowest risk scores
  2. Discard the risk registers and start over
  3. Standardize the risk assessment methodology and scoring criteria across the enterprise Correct answer.
  4. Let each subsidiary continue independently and average the results

Explanation

A common methodology and scoring criteria allow risks from different units to be compared and aggregated meaningfully at the enterprise level. Averaging incompatible scales or reporting selectively would misrepresent overall exposure.

Question 50Security Governance

A critical supplier suffers a breach that affects the organization, but the contract contains no security notification clause. Which governance lesson is most important?

  1. Contracts should include security obligations, notification timelines, and audit rights Correct answer.
  2. Insurance eliminates the need for contractual controls
  3. Incident response should be outsourced to the supplier
  4. The organization should stop using all suppliers

Explanation

Contracts are a primary governance lever for third-party risk; they should specify security obligations, breach notification timelines, and audit or assurance rights. Relying on insurance or post-incident reactions does not substitute for contractual controls.