Vendor Contract Risks: Missing NDAs for Device Support

CAS-005 By islever Editorial Last updated

Given a scenario, perform risk management activities. Given a scenario, integrate appropriate controls in the design of a secure architecture.

Short answer

B The lack of an NDA with the support company creates a significant risk of unauthorized data disclosure from sensitive printer and multifunction device storage.

Question

The information security manager at a 24-hour manufacturing facility is reviewing a contract for potential risks to the organization. The contract pertains to the support of printers and multifunction devices during non-standard business hours. Which of the following will the security manager most likely identify as a risk?
  1. Print configurations settings for locked print jobs
  2. The lack of an NDA with the company that supports its devices Correct Answer
  3. The lack of an MSA to govern other services provided by the service provider
  4. The lack of chain of custody for devices prior to deployment at the company

Key Takeaways

The trap is focusing on technical settings (A) or broad agreements (C) instead of recognizing that data confidentiality is the primary risk when vendors handle devices containing potentially sensitive information.

This question highlights the importance of NDAs in vendor contracts for device support. Without an NDA, sensitive data stored on printers and multifunction devices may be exposed to unauthorized personnel.

Common mistake: Many might choose C (MSA) because it sounds like a comprehensive contract. However, an MSA governs business terms, whereas an NDA specifically protects confidential information, which is the key vulnerability here.

Expert Analysis

The scenario focuses on risk management within the context of third-party vendor contracts, specifically for hardware support services. The core issue is identifying what legal or procedural gap poses the most significant security risk to the organization.

Option B, the lack of a Non-Disclosure Agreement (NDA), is a critical oversight. In a manufacturing facility, printers and multifunction devices often store sensitive data (e.g., confidential documents, engineering specs) on their hard drives or in temporary memory. If the external support company accesses these devices during non-standard hours without a legally binding NDA, there is no contractual protection against data leakage or unauthorized disclosure. This directly exposes the organization to intellectual property theft and compliance violations.

Option A refers to technical controls (locked print jobs), which mitigate printing risks but do not address the contractual/legal risk posed by the vendor itself. Option C mentions an MSA; while important for broader service governance, the immediate risk regarding device support and data access is better addressed by specific confidentiality clauses (NDAs). Option D, chain of custody, is relevant for new device deployment but less critical for ongoing support of existing devices where the primary concern is data exposure during maintenance.

Therefore, the absence of an NDA represents the most direct and severe risk related to information security and data privacy in this vendor relationship.

Exam Strategy

When evaluating vendor contracts, always prioritize data confidentiality and privacy protections. Look for gaps in NDAs or data processing agreements, especially when vendors have physical access to hardware that stores organizational data. Technical controls are secondary to legal safeguards against data exfiltration.

Frequently Asked Questions

Why is an NDA more critical than an MSA in this scenario?

An MSA sets general business terms, but an NDA specifically legally binds the vendor to keep your proprietary data secret. Without it, they can legally share or mishandle sensitive info found on devices.

Do printers really store sensitive data?

Yes. Modern multifunction devices often have hard drives or flash storage that cache printed/copied/scanned documents. This data must be secured and accessed only by authorized personnel.

More CAS-005 FAQ →

Discussion 1 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 1

  1. jamestkd 👍 1 Answered C
    A Master Services Agreement (MSA) is a legal contract between two parties—typically a service provider and a client—that establishes the core terms and conditions governing all current and future business transactions, projects, or engagements between them.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Cloud Security Logic Flaw: False Negative in Device Compliance

S-grade

Which Threat Best Explains Inaccurate AI Output

S-grade

What Should an Org Do First with Threat Intelligence on a Targeted Web Server?

S-grade

Differentiating Global Endpoint Telemetry by Office

S-grade

Practice All CAS-005 Questions

Access 135 questions with complete answers and detailed explanations.

View Full CAS-005 Practice Test →

← Back to CAS-005 Study Guide