CISM Question 357

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• 1

  best answer would be compliance to PDPA or similar regulations, but if hypothetically the org have implemented controls/practices based on industry standard, B would be a great answer

• Chose D1

  The vendor complies with the organization's information security policies (option B) is important, those policies may vary from one organization to another and may not cover all security aspects that industry standards encompass. Therefore, industry security standards are often considered a more critical benchmark when outsourcing critical functions like payroll processing.

• 1

  Question says 'from a security perspective' therefore answer is B. The Security Manager will not be concerned about the legal or performance stuff contained in the SLA