Exam CISM topic 1 question 147 discussion

the key words are " to help ensure alignment". This is done by KPI's.

D. Right-to-audit clause Including a right-to-audit clause in your contract with a critical service provider is crucial for maintaining transparency and verifying compliance with the organization's information security standards. This clause grants the organization the authority to conduct audits or assessments of the vendor’s practices, procedures, and performance to ensure they adhere to the agreed-upon terms and conditions, particularly those related to information security. This capability is vital for detecting and addressing potential security vulnerabilities, ensuring that the service provider's security measures align with the organization's requirements, and safeguarding sensitive information.

Part of me Feels D would be right if this was the CISA exam but is C for this.

Do you put KPIs in a contract?!? what you should put is SLAs, right? but KPIs!? I would go for D

3.13.2 managing inf risk on day to day basis -> KP|

Right to audit

D. A right-to-audit clause allows the organization to conduct periodic audits or assessments of the service provider's security practices, processes, and compliance with the terms of the contract. This is crucial for maintaining visibility into the security measures and practices of the service provider, ensuring that they are in line with the organization's information security program, and verifying that the service provider is meeting agreed-upon security standards and requirements.

KPIs as an objective : yes. KPIa an an outcome : no.

C. Key performance indicators (KPIs)

A "Right-to-audit clause" is the MOST important to include in a contract with a critical service provider to help ensure alignment with the organization's information security program. This clause allows the organization to conduct audits on the provider's security controls, processes, and policies to ensure that they meet the organization's requirements and standards. By including this clause, the organization can monitor the provider's security posture and address any identified security issues before they become a significant risk to the organization.

D is not the most important. Sometime small business does not have right to audit public cloud. So KPI or SLA is the MOST important.

Naturally is D

KPI is incorrect it should be SLA instead. So the best answer is D.

A right-to-audit clause in a contract with a critical service provider is important to include in order to ensure alignment with the organization's information security program. This clause gives the organization the ability to conduct audits on the service provider's security practices and ensure that they are meeting the standards and requirements set forth in the contract. This can help to identify any potential security risks or vulnerabilities and take steps to address them before they can cause harm to the organization. The other options are also important to include, but are not as critical to ensure alignment with the organization's information security program.

D. Right-to-audit

Clearly, D.

D I think