ISACA Certified Information Security Manager Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C2

  I agree C seems to be correct.

• Chose C1

  Answer: C. Due diligence activities are: Requirements, Questionnaire, Supplier Interviews, Risk Analysis, & Contract. Security should be included as soon as possible to define Requirements.

• Chose C3

  By involving the security team in the procurement process, you can proactively address security concerns from the outset. This allows security professionals to assess the third party's security posture, ensure that security requirements are adequately addressed in the contract, and provide valuable input to the negotiation process. It helps in aligning the security needs of the organization with the contractual agreements, leading to a more secure and compliant relationship with the third party. While other options, such as reviewing the contract with the legal department (option A), communicating security policies with the third-party vendor (option B), and conducting an information security audit (option D) are important steps, involving security in the procurement process is the proactive approach that can prevent security issues before they arise.