Program Communication and External Management CISM Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A healthcare organization is about to sign a contract with a cloud-based email security provider. The provider will process protected health information (PHI) and will use a subcontractor for data analytics. The CISO wants to ensure the organization's third-party risk is managed throughout the relationship. Which action is most important to include in the initial contracting phase?

   • ARequire the provider to complete a security questionnaire and provide evidence of a recent SOC 2 Type II report.
   • BSchedule an annual on-site audit of the provider's data center and require 30 days' advance notice of any security incident.
   • CRely on the provider's public documentation and trust their compliance with HIPAA because they are a large, well-known company.
   • DInclude contractual clauses that require the provider to notify the organization of any subcontractor changes and to ensure subcontractors meet equivalent security requirements.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A company with a remote workforce wants to improve its security awareness training. The employees are spread across different time zones and have varying levels of technical expertise. The CISO wants to ensure that the training is effective and engaging. Which delivery method is most appropriate?

   • ASelf-paced online training modules that employees can complete at their convenience, with interactive elements and quizzes.
   • BMandatory in-person training sessions at the company headquarters, scheduled during business hours.
   • CA single live webinar that all employees must attend at a specific time.
   • DA printed handbook that is mailed to each employee's home.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the primary purpose of including an incident notification clause in a contract with a third-party provider?

   • ATo ensure the organization is informed of security incidents promptly
   • BTo require the provider to pay for incident response
   • CTo allow the organization to terminate the contract immediately
   • DTo transfer liability for all incidents to the provider
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A global retailer's primary IT outsourcing provider has just informed the CISO that it will be subcontracting the management of the retailer's customer database to a new fourth-party vendor. The retailer's contract with the provider requires the provider to obtain approval before changing subcontractors. The CISO has 30 days to respond. What is the most appropriate action for the CISO to take?

   • AAsk the provider to sign an indemnification clause that holds the retailer harmless for any breach caused by the fourth party.
   • BDeny the change outright because any new fourth party introduces unacceptable risk.
   • CApprove the change immediately to avoid disruption, and request a copy of the fourth-party's security certifications after the transition.
   • DConduct a security assessment of the fourth-party vendor, including their security posture, data handling practices, and compliance with relevant regulations, before making a decision.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   When designing an information security awareness and training program, which factor is MOST important to consider to ensure the program is relevant and effective?

   • AThe personal preferences of the security team
   • BThe latest industry trends in training technology
   • CThe organization's roles, culture, and risk profile
   • DThe number of training modules available from vendors
   Reveal Solution Discussion Select an answer first