CISM Information Security Programme Practice Question
An organization is designing a third-party risk management (TPRM) program. They have identified a vendor that stores sensitive customer data. According to best practices, what should be the minimum requirement for this vendor's contract?
⚠ Common exam trap
CISM often tests the misconception that a SOC 2 report or insurance certificate alone is sufficient due diligence, when the enforceable contract with security requirements and audit rights is the foundational control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Contractual security requirements and right to audit
For a vendor storing sensitive customer data, the contract must include explicit security requirements (e.g., encryption, access controls, breach notification) and a right to audit, which gives the organization the legal ability to verify compliance. This is the minimum contractual safeguard recommended by TPRM best practices. Without these clauses, the organization has no enforceable mechanism to ensure the vendor protects data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Vendor's insurance certificate
Why it's wrong here
An insurance certificate evidences financial capacity to pay claims after a breach; it imposes no security obligation on the vendor. Contracts covering sensitive customer data require data protection, breach notification and audit clauses, with insurance as a supplementary commercial term.
- ✗
Annual self-assessment questionnaire only
Why it's wrong here
An annual self-assessment questionnaire relies on vendor-supplied attestations, giving no independent verification that controls protecting sensitive customer data actually operate. It suits low-risk vendors handling non-sensitive information. Here, the vendor stores sensitive customer data, so the contract must mandate independent assurance, such as a SOC 2 Type II report or right-to-audit clause.
- ✓
Contractual security requirements and right to audit
Why this is correct
Contractual security requirements plus right to audit give the organisation enforceable obligations and verification over a vendor holding sensitive customer data. This satisfies the stem's minimum requirement by enabling both control specification and independent assurance, which certifications alone cannot guarantee.
- ✗
SOC 2 Type II report without contractual clauses
Why it's wrong here
A SOC 2 Type II report alone provides assurance but imposes no enforceable data-protection obligations, breach-notification duties or audit rights on the vendor. It is tempting because SOC 2 reports genuinely evidence controls over time, and would suit low-risk vendors handling non-sensitive data where contractual clauses are unnecessary.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.