CISM Information Security Risk Management Practice Question
A multinational corporation is assessing the risk of data breaches from third-party vendors. The CISM is tasked with selecting a risk treatment strategy. The organization has a low risk appetite for data breaches. Which strategy should be prioritized?
⚠ Common exam trap
Watch out — candidates often default to mitigation (audits) as the standard response, failing to recognize that when risk appetite is explicitly low, avoidance is the mandated first-line strategy per ISACA's risk treatment hierarchy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Avoid the risk by not engaging vendors that cannot meet security requirements.
Given the organization's low risk appetite for data breaches, the most appropriate strategy is to avoid the risk entirely by not engaging vendors that cannot meet security requirements. This aligns with the principle that when risk exceeds the acceptable threshold, avoidance is the prioritized treatment. Avoidance eliminates the risk source, whereas other strategies like mitigation or transfer still retain some residual risk that may be unacceptable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Mitigate the risk by conducting regular vendor audits.
Why it's wrong here
Mitigation reduces but does not eliminate risk; may still exceed appetite.
- ✓
Avoid the risk by not engaging vendors that cannot meet security requirements.
Why this is correct
Avoidance eliminates the risk entirely, fitting low appetite.
- ✗
Transfer the risk by requiring vendors to have cyber insurance.
Why it's wrong here
Insurance addresses financial impact but not the risk of breach itself.
- ✗
Accept the risk because third-party risks are unavoidable.
Why it's wrong here
Acceptance is not appropriate when risk appetite is low.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.