hardMultiple ChoiceObjective-mapped
CRISC Practice Question: Uses a third-party vendor for critical data…
An organization uses a third-party vendor for critical data processing. The vendor has experienced two minor security incidents in the past year with no data loss. The risk manager is updating the vendor risk assessment. Which approach best aligns with ISACA's guidance?
⚠ Common exam trap
It's easy for candidates to assume no data loss means no risk, but ISACA requires proactive reassessment of controls after any incident to prevent escalation, not passive acceptance or superficial monitoring.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Initiate a formal reassessment of the vendor's security controls and contractual protections.
ISACA's guidance emphasizes that even minor security incidents without data loss indicate potential control weaknesses that require reassessment. A formal reassessment (A) ensures the vendor's security controls and contractual protections are re-evaluated to address underlying risks, aligning with the principle of continuous risk monitoring and response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Initiate a formal reassessment of the vendor's security controls and contractual protections.
Why this is correct
Recurring incidents warrant a full reassessment to determine if the vendor's risk profile has changed.
- ✗
Increase the frequency of vendor audits to quarterly.
Why it's wrong here
Audits are part of monitoring, but a reassessment should be done first to understand current risk posture.
- ✗
Request a copy of the vendor's SOC 2 report from last year.
Why it's wrong here
Requesting a prior-year SOC 2 report provides only a point-in-time snapshot of controls, not current assurance. The vendor’s recent incidents indicate ongoing risk that a stale report cannot address; ISACA’s guidance requires continuous monitoring or a fresh assessment. This option is tempting because SOC 2 reports are standard for evaluating service organisation controls, and would be correct if the vendor had no recent incidents and the report covered the current period.
- ✗
Accept the risk because the incidents did not result in data loss.
Why it's wrong here
Acceptance without reassessment ignores the potential for future incidents with greater impact.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.