CRISC Risk Response and Reporting Practice Question
A company is assessing a new vendor that will have access to its customer database. The vendor's security questionnaire reveals they lack SOC 2 certification. According to risk tiering, the vendor is classified as critical. What should the company do?
⚠ Common exam trap
The trap here is that candidates may underestimate the importance of independent audit evidence for critical vendors and mistakenly choose increased monitoring (Option C) as a sufficient compensating control, when in fact it does not address the root need for verified, preventive controls before data access is granted.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Require the vendor to obtain SOC 2 Type II certification before contract signing.
A critical-tier vendor with access to sensitive customer data requires independent assurance of security controls. SOC 2 Type II certification provides a rigorous, audited assessment of controls over a period of time, which is essential for a high-risk vendor. Requiring this certification before contract signing ensures the vendor meets the necessary security baseline before any data is exposed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Accept the vendor because the questionnaire indicates other strong controls.
Why it's wrong here
Accepting without meeting minimum requirements for critical tier violates risk appetite.
- ✓
Require the vendor to obtain SOC 2 Type II certification before contract signing.
Why this is correct
For critical vendors, SOC 2 Type II is typically mandatory; the vendor must comply or be rejected.
- ✗
Proceed with the contract but increase monitoring frequency.
Why it's wrong here
For critical vendors, minimum requirements must be met; increased monitoring is not a substitute for lacking certification.
- ✗
Lower the vendor's tier to medium to avoid the requirement.
Why it's wrong here
Risk tiering should be based on actual risk, not to bypass requirements.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 983-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.