Isaca Updated CISM Exam Questions and Answers by yasmin

A security baseline is a set of minimum security requirements for a system or asset type. The CISM Review Manual states that a baseline should be uniform for all assets of the same type to ensure consistency, enforceability, and ease of monitoring. This standardization supports effective compliance and security operations. While other factors can influence baseline adjustments, uniformity for similar asset types is most critical.

The most effective way to obtain assurance of a vendor’s security practices is requiring periodic independent third-party reviews (C). In CISM governance and third-party risk management, independent assurance is the strongest mechanism to validate that security controls are not only documented but also designed appropriately and operating effectively. Third-party reviews (such as SOC reports or independent audits) provide objective evidence and reduce reliance on vendor self-reporting.

Requiring BCPs (A) focuses primarily on availability and resilience, not the overall security posture. Reviewing security disclosures (B) is reactive and limited to known issues disclosed by the vendor. Reviewing SLAs (D) confirms contractual expectations but does not validate actual control effectiveness. CISM emphasizes that governance over outsourced services must include ongoing, independent assurance activities to ensure continued alignment with risk appetite and regulatory obligations.

Periodic independent reviews also support accountability, enable risk-based decision-making, and provide defensible evidence of due diligence to senior management and regulators.