CISM Information Security Programme Practice Question
An organization is implementing a vendor tiering program for third-party risk management. Which TWO criteria should be used to classify vendors into high, medium, or low risk tiers? (Select TWO)
⚠ Common exam trap
CISM often tests whether candidates confuse commercial/contractual attributes (contract length, vendor revenue) with genuine risk attributes (data sensitivity, service criticality) — the exam expects risk-based thinking, not procurement-based thinking.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Type and sensitivity of data accessed
Option B is correct because the type and sensitivity of data a vendor accesses directly determines the potential impact of a breach — vendors handling regulated data such as PII, PHI, or PCI cardholder data warrant higher risk tiers than those with no data access. Option D is correct because the criticality of the service provided reflects how much business disruption would occur if the vendor failed, making it a core input to tiering under frameworks like NIST and ISO 31000. Options A, C, and E are not primary tiering criteria: contract length does not indicate inherent risk, annual revenue reflects vendor size rather than the risk it poses to the organization, and geographic location is at most a secondary or contextual factor rather than a defining classification criterion.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Length of contract
Why it's wrong here
Contract length reflects commercial commitment, not the risk a vendor introduces; tiering uses data sensitivity, system access, and business criticality. It tempts because long engagements imply dependency, yet a short contract for critical data access still warrants a high-risk tier.
- ✓
Type and sensitivity of data accessed
Why this is correct
Data type and sensitivity directly determine breach impact and regulatory exposure, making them the primary axis for tiering. Vendors handling regulated or confidential data warrant deeper due diligence than those processing public information, so this criterion scales assessment effort to actual risk.
- ✗
Vendor's annual revenue
Why it's wrong here
Annual revenue reflects the vendor's size, not the likelihood or impact of a breach affecting the organisation, so it cannot drive tiering. It is tempting because financial scale is a common procurement metric, and revenue would be relevant when assessing a vendor's financial stability or creditworthiness rather than its inherent risk exposure.
- ✓
Criticality of service provided
Why this is correct
Service criticality determines operational impact if the vendor fails, independent of data sensitivity. A vendor supporting essential business functions demands higher-tier oversight even without sensitive data, so this criterion captures availability and continuity risk that data classification alone misses.
- ✗
Vendor's geographic location
Why it's wrong here
Geographic location alone does not indicate risk exposure; tiering depends on data sensitivity and access, service criticality, and security posture. It tempts because jurisdiction affects breach notification and privacy obligations, but location is a secondary factor, not a primary classification criterion.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.