CISM Information Security Programme Practice Question
A company is designing a third-party risk management (TPRM) program. Which THREE of the following are essential components of the ongoing monitoring phase for a critical vendor?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Annual reassessment of the vendor's security controls
Ongoing monitoring includes continuous assessment of security posture. Annual reassessment is part of the cycle, but ongoing monitoring includes more frequent checks. Contractual requirements are set during onboarding, not monitored ongoing. Exit procedures are for termination.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Annual reassessment of the vendor's security controls
Why this is correct
Annual reassessment is part of ongoing monitoring cycle.
- ✗
Contractual requirement for data encryption
Why it's wrong here
This is a contract clause, not an ongoing monitoring activity.
- ✓
Periodic review of vendor's security certifications (e.g., SOC 2)
Why this is correct
Part of ongoing monitoring.
- ✗
One-time onboarding risk assessment
Why it's wrong here
Onboarding assessment is initial, not ongoing.
- ✓
Continuous monitoring of vendor's external attack surface
Why this is correct
Proactive monitoring of vulnerabilities.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.