CISM Information Security Programme Practice Question
During third-party risk assessment, a vendor is found to have access to sensitive customer data. The vendor's own supply chain includes a critical fourth-party component. What is the BEST way to address this nth-party risk?
⚠ Common exam trap
CISM often tests the misconception that an organization must directly assess all parties in its supply chain, when in fact the best practice is to require the vendor to manage and assess its own suppliers through contractual flow-down.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Request the vendor to assess and pass through security requirements to its suppliers
The organization cannot directly assess every fourth party in its vendor's supply chain, but it can contractually require the vendor to flow down security requirements and assess its own suppliers. This is the standard nth-party risk management approach recommended by frameworks like NIST SP 800-161 and ISO 28000. It maintains accountability through the vendor while extending controls to the fourth party.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ignore the fourth party as it is outside the organization's scope
Why it's wrong here
Ignoring the fourth party leaves the risk unmanaged, yet the organisation remains accountable for customer data flowing through that component. Ignoring is defensible only when the fourth party has no access to sensitive data and no material operational dependency exists.
- ✗
Conduct a direct assessment of the fourth party
Why it's wrong here
Direct assessment bypasses the vendor's own governance and is often contractually impossible; the organisation should obtain assurance through the vendor instead. Direct assessment suits a fourth party the organisation contracts with itself, not one buried in a vendor's supply chain.
- ✗
Terminate the contract with the vendor
Why it's wrong here
Terminating the contract removes the service but does not address the fourth-party exposure embedded in the vendor's supply chain, and may breach continuity requirements. Termination is the right response when the vendor itself fails due diligence and no remediation path exists.
- ✓
Request the vendor to assess and pass through security requirements to its suppliers
Why this is correct
Fourth-party risk cannot be assessed directly by the organisation, so contractual flow-down is the practical control. Requiring the vendor to assess its own suppliers and pass through equivalent security requirements extends governance across the supply chain, satisfying the nth-party visibility constraint the stem describes.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.