CISM Question 81

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• 3

  Answer is A Including information security clauses within contracts is the most effective way for an organization to ensure its third-party service providers are aware of information security requirements and expectations. By explicitly outlining information security requirements and expectations within contracts, organizations establish clear guidelines and obligations for third-party providers to adhere to. These clauses may cover aspects such as data protection, confidentiality, access controls, incident response procedures, and compliance with relevant regulations. While auditing the service delivery of third-party providers (Option B), providing information security training to third-party personnel (Option C), and requiring third parties to sign confidentiality agreements (Option D) are all important measures, including information security clauses within contracts establishes a formal agreement and legal framework that explicitly addresses information security concerns and responsibilities.

• Chose A6

  The third party could have 100s to 1000s of customers. They are not going to waist thier man hours getting trained on the security requirements of a single customer. Easy answer... A

• Chose A2

  " are AWARE of information security requirements and expectations". AWARE is the key word, so when you sign a contract, you make them legally aware by adding infosec clauses to the contract. You don't just go and train them, ffs. :)