ISC Leadership And Organizational Management Practice Question
Your organization is evaluating the procurement of a new SaaS platform. As the ISSMP, you are responsible for integrating security into the vendor risk management process. Which action is most critical during the 'Due Diligence' phase?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Reviewing the vendor's SOC 2 Type II report for documented control effectiveness
Reviewing the vendor's SOC 2 Type II report is the standard practice for verifying the effectiveness of security controls over a period of time, ensuring they meet organizational security requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Requesting the vendor's penetration test results from five years ago
Why it's wrong here
Outdated test results do not provide valid assurance of current security posture.
- ✓
Reviewing the vendor's SOC 2 Type II report for documented control effectiveness
Why this is correct
The SOC 2 Type II provides independent audit evidence of control operational effectiveness.
- ✗
Verifying the vendor's office location and physical building security
Why it's wrong here
Physical security is relevant, but it is not the most critical component for a cloud/SaaS vendor.
- ✗
Ensuring the vendor signs a standard non-disclosure agreement
Why it's wrong here
NDAs protect confidentiality but do not validate the security posture of the vendor.
About these practice questions
One of 219 original ISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official (ISC)² exam blueprint
This ISC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ISC exam.