CISM Information Security Risk Management Practice Question
An organization is implementing a new cloud-based ERP system. As part of the emerging risk assessment, the information security manager needs to identify potential risks associated with the cloud migration. Which THREE of the following should be considered as part of the emerging risk assessment for cloud adoption?
⚠ Common exam trap
ISACA often tests the distinction between operational risks (like patching) and emerging risks (like regulatory or supply chain changes), leading candidates to select patching as a cloud-specific risk when it is actually a routine operational task that the organization already manages.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data residency and regulatory compliance requirements across different jurisdictions.
Data residency and regulatory compliance requirements are critical in cloud adoption because data may be stored or processed in jurisdictions with different privacy laws (e.g., GDPR, CCPA, LGPD). An emerging risk assessment must evaluate whether the cloud provider's data centers are located in regions that could expose the organization to legal penalties or breach of contractual obligations. This is not a generic concern but a specific legal and technical risk tied to the physical location of cloud infrastructure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Data residency and regulatory compliance requirements across different jurisdictions.
Why this is correct
Data may be stored in different countries, raising compliance issues.
- ✓
Potential supply chain risks if the cloud provider uses third-party services or subcontractors.
Why this is correct
Supply chain attacks (e.g., SolarWinds) are a key emerging risk in cloud adoption.
- ✗
The organization's ability to patch operating systems in the cloud environment.
Why it's wrong here
Patching is typically the cloud provider's responsibility under the shared responsibility model.
- ✗
Physical security controls at the cloud provider's data centers.
Why it's wrong here
Physical security is the provider's responsibility; customers rely on certifications like SOC 2.
- ✓
Shared responsibility model and understanding the division of security controls between the organization and the provider.
Why this is correct
Misunderstanding the shared responsibility model can lead to security gaps.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.