Exam CISA topic 1 question 1234 discussion

RIsk assessmenta; it provides a foundational understanding of the risks associated with the SaaS vendor, allowing management to make an informed decision. Identifying and evaluating these risks helps ensure that the selected vendor aligns with the organization’s risk tolerance and overall strategy. While determining service level requirements (SLAs) is important to ensure the vendor meets the organization's performance expectations, it is secondary to assessing the risks associated with the vendor.

Before selecting a SaaS vendor, it is essential to define and establish clear service level requirements (SLRs) or service level agreements (SLAs). These SLRs/SLAs specify the performance, availability, reliability, security, and support levels expected from the SaaS vendor.