Information Systems Acquisition, Development, and Implementation →mediumMultiple SelectObjective-mapped
CISA Practice Question: Information Systems Acquisition, Development, and Implementation
An organization is evaluating two vendors for a critical cloud-based ERP system. Which TWO contractual clauses are most important to include to ensure the organization can monitor vendor performance and security? (Select TWO)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Audit rights
Service level agreements (SLAs) define performance metrics and remedies for breaches, ensuring accountability. Audit rights allow the organization to verify the vendor's controls, which is essential for security and compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data ownership clause
Why it's wrong here
Data ownership clarifies who owns the data but does not enable monitoring.
- ✗
Indemnification clause
Why it's wrong here
Indemnification addresses liability but does not provide ongoing monitoring capability.
- ✓
Audit rights
Why this is correct
Audit rights allow the organization to assess the vendor's security and operational controls.
- ✓
Service level agreements (SLAs)
Why this is correct
SLAs establish performance expectations and remedies, enabling monitoring of vendor performance.
- ✗
Non-disclosure agreement (NDA)
Why it's wrong here
NDA protects confidential information but does not directly enable monitoring of performance or security.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 995 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.