CISM Information Security Programme Practice Question
In a vendor tiering system for third-party risk management, which factor is most critical for determining the tier?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Vendor's data access and service criticality
The vendor's access to sensitive data and the criticality of the service to business operations are the primary factors for tiering, as they directly impact risk exposure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Vendor's data access and service criticality
Why this is correct
Tiering hinges on the inherent risk a vendor introduces, which is driven by the sensitivity of data it accesses and how critical its service is to operations. These two factors determine the depth of due diligence and contractual controls applied, making them the primary tiering criteria.
- ✗
Vendor's annual revenue
Why it's wrong here
Revenue indicates vendor size, not the risk exposure the vendor introduces through data access, system criticality or service dependency. Tiering hinges on inherent risk to the organisation. Revenue would matter when assessing financial stability or concentration risk, but it does not determine how much oversight a vendor requires.
- ✗
Vendor's geographic location
Why it's wrong here
Geography alone does not capture the data sensitivity, system criticality or access privileges that determine inherent vendor risk. Tiering is driven by the impact of vendor failure or compromise. Location would be relevant when assessing jurisdictional, regulatory or cross-border data transfer obligations, not the overall tier.
- ✗
Vendor's number of employees
Why it's wrong here
Headcount reflects vendor scale, not the criticality or sensitivity of the service the vendor delivers. Tiering depends on the risk the relationship poses to the organisation's data and operations. Employee numbers would inform capacity or resilience assessments, but they do not drive the oversight level assigned.
Go deeper
Related to this question
About these practice questions
One of 924 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.