hardMultiple ChoiceObjective-mapped
CISM Practice Question: A global financial services firm with 15,000…
A global financial services firm with 15,000 employees has recently experienced a significant data breach due to inadequate oversight of third-party vendors. The breach originated from a cloud service provider that had been granted elevated access without a formal risk assessment or contract review. The board has directed the CISO to overhaul the information security governance framework to prevent recurrence. Currently, the organization has a decentralized security model where each business unit manages its own vendor relationships. The CISO proposes a centralized governance body. Which of the following is the BEST course of action to establish effective governance over third-party risk?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Establish a central third-party risk management program with a defined policy and vendor assessment process
It directly addresses the root cause: lack of centralized oversight. A formal third-party risk management (TPRM) program with a defined policy and vendor assessment process provides consistent governance across all business units, ensuring that vendors are properly vetted before being granted access. Option B (penetration tests) is a technical control, not a governance framework. Option C (training) addresses awareness but does not establish oversight or process. Option D (contract clauses) is a component of a broader program but alone is insufficient for comprehensive governance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Establish a central third-party risk management program with a defined policy and vendor assessment process
Why this is correct
Centralized program ensures consistent governance and oversight of all vendor relationships.
- ✗
Conduct quarterly penetration tests on all third-party systems
Why it's wrong here
Penetration testing is a control but does not address governance framework gaps.
- ✗
Provide annual security awareness training for employees managing vendors
Why it's wrong here
Training alone does not enforce oversight or accountability.
- ✗
Mandate that all vendor contracts include data protection clauses
Why it's wrong here
Contract clauses are necessary but insufficient without governance processes.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.