mediumMultiple Choice
CISA Practice Question: Is considering outsourcing its IT infrastructure…
An organization is considering outsourcing its IT infrastructure management. Which of the following is the MOST important factor to include in the service level agreement (SLA)?
⚠ Common exam trap
CISA often tests the distinction between foundational SLA elements (KPIs and reporting) and secondary provisions (penalties, staffing, inventory) — candidates are tempted to pick penalty clauses, but without defined KPIs and reporting, penalties cannot be applied.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Definition of key performance indicators (KPIs) and reporting frequency.
The most important element of an SLA for outsourced IT infrastructure is a clear definition of KPIs and the frequency of reporting against them, because KPIs are the measurable criteria that determine whether the vendor is meeting the agreed service levels. Without well-defined KPIs and reporting, the SLA cannot be enforced, performance cannot be objectively assessed, and remedies (including penalties) have no basis. This is the foundation on which all other SLA provisions rest.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Definition of key performance indicators (KPIs) and reporting frequency.
Why this is correct
Defined KPIs with reporting frequency make the provider's performance measurable and enforceable, directly satisfying the SLA's need for objective, auditable service commitments. Without quantified metrics and a stated reporting cadence, the organisation cannot verify delivery, trigger remedies, or evidence due diligence to auditors assessing third-party management.
- ✗
List of hardware and software to be managed.
Why it's wrong here
An inventory of managed hardware and software defines scope, not performance. An SLA must specify measurable service levels—availability, response and resolution times—against which the vendor is held accountable. The asset list belongs in the contract's scope annex, and would be the right artefact when defining boundaries for a fixed-price support agreement.
- ✗
Staffing levels and qualifications of vendor personnel.
Why it's wrong here
Vendor staffing numbers and qualifications are inputs the provider controls internally, not service commitments the customer can measure. An SLA must state outcome metrics such as uptime percentages and incident response targets. Staffing schedules fit a resourcing plan, and would be the correct artefact when auditing a vendor's capability during due diligence.
- ✗
Price reduction clauses for non-compliance.
Why it's wrong here
Price reduction clauses are remedies applied after a breach, not the service commitment itself. An SLA must first define measurable performance targets—availability, response and resolution times—that trigger such credits. Penalty clauses belong in the commercial terms, and would be the right focus when negotiating financial remedies for repeated underperformance.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.