CISM Information Security Programme Practice Question
A CISO is evaluating a cloud provider's security posture. Which of the following should be the MOST important consideration in the vendor risk assessment?
⚠ Common exam trap
CISM often tests the difference between evidence-based assurance (SOC 2, ISO 27001) and superficial factors (brand, pricing, location), so candidates choose reputation or data center location because they sound like reasonable business considerations rather than auditable security evidence.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The provider's certifications and SOC 2 reports
Independent third-party attestations such as SOC 2 reports and certifications (ISO 27001, FedRAMP, PCI DSS) provide verifiable evidence of the provider's security controls, making them the most important consideration in a vendor risk assessment. They allow the CISO to evaluate the provider's actual control environment rather than relying on marketing claims, brand reputation, or pricing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The provider's certifications and SOC 2 reports
Why this is correct
Independent certifications and SOC 2 reports provide audited, third-party evidence of the provider's control environment, letting the CISO assess posture without relying on self-attestation. This satisfies the stem's most-important consideration by supplying verifiable assurance about the controls protecting the organisation's data.
- ✗
The provider's data center locations
Why it's wrong here
Data centre locations address jurisdictional and residency concerns, not the provider's technical and operational security controls. It is tempting because geography genuinely matters for data sovereignty, and would be decisive where regulations mandate in-country storage.
- ✗
The provider's market share and brand reputation
Why it's wrong here
Market share and brand reputation are commercial signals, not evidence of the provider's security controls or breach history. It is tempting because a large, well-known provider appears trustworthy, and reputation would matter as a secondary factor once security requirements are satisfied.
- ✗
The provider's pricing compared to competitors
Why it's wrong here
Pricing reflects commercial cost, not the security controls protecting the organisation's data, so it cannot evidence the provider's security posture. It is tempting because cost is a standard vendor assessment criterion, and would be central when selecting between providers with equivalent security.
Go deeper
Related to this question
About these practice questions
One of 924 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.