Which term describes the action of creating a formalized process and incident report form for your vendor to utilize?

• A. Vendor Incident Form
• B. Security Policy
• C. Device Configuration
• D. Formal Process

Answer: (C)

Creating a formalized process and an incident report form for a vendor to use is about establishing a standardized, repeatable procedure for how incidents are handled and documented. This action is best described as implementing a formal process. It signals that there are defined steps, roles, responsibilities, and a specific form the vendor will use to report incidents, ensuring consistency and governance across interactions with the vendor.

The incident form by itself is just a single document, not the full procedure. A security policy outlines overarching rules but doesn’t necessarily define the step-by-step process or the exact form the vendor should use. Device configuration concerns setting up or adjusting hardware or software, which is unrelated to creating a vendor incident-handling process.