Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified Information Security Manager · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
The key phrase is: organization's information security requirements That matters. The strongest assurance comes from the organization having the ability to audit the provider’s systems, controls, and processes against its own specific requirements, not just against generic standards. This is stronger than relying only on what the provider says or what an external report says about general standards. Why D is wrong: A provider could comply with an industry standard and still fail to meet your organization’s contractual requirements, data handling obligations, notification timelines, access control expectations, or regulatory needs.
An independent review report (for example, a SOC report or an independent certification assessment) provides objective, third-party validation that the service provider's controls have been evaluated and found to comply with recognized standards. This offers the strongest evidence that security requirements are being met.
The BEST option for assurance is B. The ability to audit the third-party supplier's IT systems and processes. Direct audit rights provide the highest level of assurance. It allows the organization to independently verify the service provider's security controls and their effectiveness. This is far more reliable than relying on self-assessments or even third-party reports, as it gives the organization direct evidence.