Isaca Updated CISM Exam Questions and Answers by karter

According to the CISM Review Manual, the information security manager should evaluate the third party’s agreements with its external provider to ensure that the security requirements and controls are adequate and consistent with the organization’s expectations. Engaging or conducting an audit may be a subsequent step, but not the most important one. Recommending canceling the contract may be premature and impractical.

References = CISM Review Manual, 27th Edition, Chapter 3, Section 3.4.2, page 1431.

The design phase of a BIA must begin with identifying critical business functions, since they determine:

Which systems/processes need protection

Recovery priorities

Acceptable downtime (RTO/MTD)

Without clearly defining what ' s critical, the BIA cannot guide resource allocation or continuity strategies effectively.

“A successful BIA must begin with identifying which business functions are critical to achieving organizational objectives.”

— CISM Review Manual 15th Edition, Chapter 3: Business Continuity and Disaster Recovery, Section: BIA Methodology*