Legal, Regulatory and Contractual Requirements CISM Practice Questions (Page 5)

Questions 21–22

1. 21foundation · easy

   Which of the following is the PRIMARY purpose of including information security clauses in a contract with a third-party service provider?

   • ATo transfer all security risks to the third party
   • BTo comply with legal requirements that mandate third-party contracts
   • CTo establish clear security expectations and obligations for both parties
   • DTo eliminate the need for ongoing security monitoring of the third party
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   An organization processes credit card transactions. Which of the following is a regulatory requirement that directly affects its information security governance?

   • AA contractual agreement with a payment processor
   • BISO/IEC 27001 certification
   • CPayment Card Industry Data Security Standard (PCI DSS)
   • DThe organization's internal password policy
   Reveal Solution Discussion Select an answer first