CISM Question 19

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B4

  I would also say B and then C. First you develop criteria that you include in vendor selection, then you go about reading third-party reports and compare what's in the report against the criteria.

• Chose B4

  Including information security criteria as part of the vendor selection process ensures that security considerations are integrated into the initial evaluation. This step involves assessing the security posture of potential vendors against predefined criteria before proceeding with further evaluation or contractual agreements. It helps filter out vendors that do not meet the required information security standards from the outset. While the other options (developing metrics for vendor performance, reviewing third-party reports, and including information security clauses in the vendor contract) are important steps in the overall vendor management process, incorporating information security criteria early in the vendor selection process is critical for establishing a foundation of security in the relationship from the beginning.

• Chose B1

  agree B.