When entering into a third party vendor agreement for security services, at what point in the process is it BEST to understand and validate the security posture and compliance level of the vendor?

SCENARIO: A Chief Information Security Officer (CISO) recently had a third party conduct an audit of the security program. Internal policies and international standards were used as audit baselines. The audit report was presented to the CISO and a variety of high, medium and low rated gaps were identified.
The CISO has implemented remediation activities. Which of the following is the MOST logical next step?

One of the MAIN goals of a Business Continuity Plan is to

Which of the following is used to establish and maintain a framework to provide assurance that information security strategies are aligned with organizational objectives?

Which of the following is MOST important when dealing with an Information Security Steering committee?