ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

Under a shared responsibility model, it is essential to spell out exactly which party is accountable, consulted, or informed for every security test in the acquisition and deployment lifecycle. A responsibility assignment matrix (commonly called a RACI) that is formally attached to, or embedded in, the master services agreement or statement of work provides that clarity. The matrix assigns roles (Responsible, Accountable, Consulted, Informed) for specific tasks such as code review, vulnerability assessment, and penetration testing, ensuring that neither the supplier nor the acquirer assumes the other will perform critical controls. A SOC 2 report, NDA, or SBOM can support due diligence, confidentiality, or component tracking, but none of them explicitly allocate day-to-day testing responsibilities between the parties.