Information Security Programme →mediumMultiple Select

CISM Information Security Programme Practice Question

An organization is designing a vendor tiering process for its third-party risk management program. Which TWO factors are MOST appropriate for determining a vendor's risk tier?

⚠ Common exam trap

CISM often tests vendor risk tiering factors; candidates may be tempted to select easily quantifiable factors like revenue or employee count, but the exam expects focus on data sensitivity and business criticality.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Type and sensitivity of data the vendor accesses

Option A is correct because the type and sensitivity of the data a vendor accesses directly drives the inherent risk of a data breach or regulatory violation, making it a primary factor in tiering (e.g., PII, PHI, or PCI data raises the tier). Option E is correct because the criticality of the vendor's service to business operations determines the impact of a vendor failure or outage on the organization's ability to function, which is a core dimension of vendor risk tiering. In contrast, Option B (geographic location) can influence risk but is not a primary tiering factor by itself and is often a sub-factor under data and operational considerations. Option C (number of employees) and Option D (annual revenue) are vendor size metrics that do not directly reflect the risk the vendor poses to the organization's data or operations, so they are not the most appropriate determinants.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Type and sensitivity of data the vendor accesses
Why this is correct
The type and sensitivity of data a vendor accesses directly determines the potential impact of a breach, making it a primary tiering factor. This satisfies the stem's requirement by tying risk tier to data criticality rather than contract value or vendor size.
✗
Vendor's geographic location
Why it's wrong here
Geographic location alone does not determine inherent risk; a vendor in a high-risk jurisdiction may still hold no sensitive data. It is tempting because location can affect regulatory exposure, but tiering should be driven by data classification, system access and business criticality instead.
✗
Number of employees at the vendor
Why it's wrong here
Headcount does not indicate the volume or sensitivity of data a vendor accesses, nor the operational dependency it creates, so it cannot drive tiering. It is tempting because larger vendors may appear riskier, and employee count is a legitimate factor in due-diligence scoping or financial-stability reviews, but not in assigning inherent risk tiers.
✗
Vendor's annual revenue
Why it's wrong here
Annual revenue indicates vendor size and commercial value, not the risk the vendor poses to the organisation. It is tempting as a proxy for importance, but tiering should reflect data sensitivity, access level and business criticality, which determine the impact of a vendor breach.
✓
Criticality of the vendor's service to business operations
Why this is correct
Vendor tiering hinges on business impact, so criticality of the service to operations directly determines how much disruption an outage or compromise would cause. This satisfies the stem's need to rank vendors by inherent risk, ensuring higher tiers receive deeper due diligence and more frequent monitoring.

Go deeper

CISM Information Security Programme Practice Question

Why each option matters

Option-by-option breakdown

Related to this question