Isaca Updated CISM Exam Questions and Answers by maira

The best way to ensure that information security concerns are considered during the procurement of SaaS solutions is to integrate information security risk assessments into the procurement process. This will allow the organization to identify and evaluate the potential security risks and impacts of using a SaaS provider, and to select the most appropriate solution based on the risk appetite and tolerance of the organization. Information security risk assessments should be conducted at the early stages of the procurement process, before selecting a vendor or signing a contract, and should be updated periodically throughout the contract lifecycle.

Providing regular information security training to the procurement team (B) is a good practice, but it may not be sufficient to address the specific security issues and challenges of SaaS solutions. The procurement team may not have the expertise or the authority to conduct information security risk assessments or to negotiate security requirements with the vendors.

Inviting IT members into regular procurement team meetings to influence best practice © is also a good practice, but it may not be effective if the IT members are not involved in the actual procurement process or decision making. The IT members may not have the opportunity or the influence to conduct information security risk assessments or to ensure that security concerns are adequately addressed in the procurement contracts.

Enforcing the right to audit in procurement contracts with SaaS vendors (D) is an important control, but it is not the most effective way to ensure that information security concerns are considered during the procurement process. The right to audit is a post-contractual measure that allows the organization to verify the security controls and compliance of the SaaS provider, but it does not prevent or mitigate the security risks that may arise from using a SaaS solution. The right to audit should be complemented by information security risk assessments and other security requirements in the procurement contracts.

References = CISM Review Manual (Digital Version), Chapter 3: Information Security Program Development and Management, Section: Information Security Program Management, Subsection: Procurement and Vendor Management, Page 141-1421

The first action the information security manager should take is to initiate the incident response process (B). According to CISM incident management principles, once there is confirmed evidence of a security incident—such as employee data being publicly disclosed—the organization must immediately activate its formal incident response procedures. This ensures that actions are coordinated, evidence is preserved, roles and responsibilities are clear, and regulatory, legal, and communication requirements are handled in a controlled manner.

Informing impacted employees (A), escalating to senior management (C), and engaging forensic experts (D) are all important steps, but they are subsequent actions that occur within the incident response process, not before it. Initiating the incident response process provides the structured framework needed to assess scope, contain damage, meet notification obligations, and determine whether forensic investigation is required.

CISM emphasizes that ad hoc actions taken outside the incident response process increase the risk of miscommunication, legal exposure, and ineffective containment. Activating the process first ensures disciplined execution aligned with governance, legal, and regulatory expectations.

The first step when a new vulnerability is identified is to re-evaluate the risk associated with the vulnerability. This may require an update to the risk assessment and the implementation of additional controls. Informing senior management of the vulnerability is important, but should not be the first step. Implementing compensating controls may also be necessary, but again, should not be the first step. Asking the business owner for a remediation plan may be useful, but only after the risk has been re-evaluated.

The information security manager should first re-evaluate the risk posed by the new vulnerability to determine its impact and likelihood. Based on this assessment, appropriate actions can be taken such as informing senior management, implementing compensating controls, or requesting a remediation plan from the business owner. The other choices are possible actions but not necessarily the first one.

A vulnerability is a weakness that can be exploited by an attacker to compromise a system or network2. A vulnerability can affect key data processing systems within an organization if it exposes sensitive information, disrupts business operations, or damages assets2. A vulnerability assessment is a process of identifying and evaluating vulnerabilities and their potential consequences2

The principle of least privilege—ensuring access is granted only to those whose job functions require it—is the primary control for securing data, especially in cloud environments.

“Access to information and systems should be based on the principles of least privilege and need to know, regardless of environment.”

— CISM Review Manual 15th Edition, Chapter 3: Information Security Program Development and Management, Section: Access Control Management

ISACA’s CISM practice questions consistently highlight this principle as central to effective cloud security.