CISM Information Security Programme Practice Question
A multinational organization is implementing a vendor risk management programme. Which THREE of the following should be included in the programme to effectively manage nth-party risk? (Select THREE.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Include contractual clauses that require vendors to pass down security requirements to subcontractors
To manage nth-party risk, the programme should require vendors to disclose their subcontractors, include contractual clauses flowing down security requirements, and have the right to audit subcontractors. Assessing all suppliers' suppliers is impractical; focusing on high-risk vendors is more feasible.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Include contractual clauses that require vendors to pass down security requirements to subcontractors
Why this is correct
Flow-down clauses ensure requirements extend to subcontractors.
- ✓
Include the right to audit subcontractors in vendor contracts
Why this is correct
Audit rights enable verification of subcontractor security.
- ✗
Conduct annual security assessments of all subcontractors
Why it's wrong here
Assessing all subcontractors is impractical; focus on high-risk ones.
- ✓
Require vendors to disclose all subcontractors and their security posture
Why this is correct
Disclosure enables visibility into nth-party risk.
- ✗
Require vendors to obtain insurance for subcontractors
Why it's wrong here
Insurance does not directly manage security risk.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.