mediumMultiple ChoiceObjective-mapped
CISA Is acquiring a third-party SaaS application Practice Question
An organization is acquiring a third-party SaaS application. Which of the following should be included in the contract to ensure data protection?
⚠ Common exam trap
Many exam-takers choose a specific technical control like encryption (Option D) because it seems directly related to data protection, but they overlook that the right to audit is the overarching governance mechanism that ensures all controls, including encryption, are actually implemented and effective.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Right to audit the vendor's security practices
A right to audit the vendor's security practices is essential in a SaaS contract because it allows the organization to independently verify that the vendor's controls (e.g., access management, patch management, incident response) meet contractual and regulatory requirements. Without this clause, the organization must rely solely on the vendor's self-assessments or third-party reports like SOC 2, which may not cover all relevant risks or may be outdated. This right is a key mechanism for ensuring ongoing data protection in a shared responsibility model.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Right to audit the vendor's security practices
Why this is correct
Right to audit enables verification of data protection controls.
- ✗
Service level agreement (SLA) for uptime
Why it's wrong here
SLA focuses on availability, not data protection.
- ✗
Data ownership and location specification
Why it's wrong here
Data ownership is important for legal reasons but not a direct protection control.
- ✗
Data encryption clause for data at rest and in transit
Why it's wrong here
Encryption is a requirement but often included in security addendum, not always contract clause.
Go deeper
Related to this question
About these practice questions
One of 995 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.