Exam CISM topic 1 question 618 discussion

Defining information security requirements and processes is the first step that the information security manager should take when supporting the organization's use of Software as a Service (SaaS). This is because it sets the foundation for the selection of a SaaS vendor that meets the organization's security needs and expectations. Without clear security requirements and processes, it may be difficult to determine the level of security that each vendor can provide, or to assess the suitability of each vendor for the organization's specific needs. By establishing the security requirements and processes first, the information security manager can ensure that the selection of a SaaS vendor aligns with the organization's overall information security strategy.

A is correct, its talking about "selecting a vendor". C would be correct if writing the RFQ

C for me

Damn...another one... So let's see... Looking at the scenario, the most logical sequence of things should be C, A, D, A. I guess if we're still in the process of selecting a vendor, that means nothing's really decided yet so first you figure out the security requirements and processes and based on that you start checking the vendors (through independent audit reports, so as objective as possible). Then when you understand all the risks with each vendor you propose mitigation. And lastly you do security monitoring of vendors services through security benchmarks.

Because the questions says "In the process". It means the requirements and process are defined already.

Analyze the risks in using SaaS solution. Identify the controls. (D) These are then translated into security requirements (C). How else will you know what the security requirements are?

Once you have identified which processes can be outsourced as well as their inherent risks, you can begin performing due diligence on potential vendors. The level of due diligence should be tailored to the significance of the relationship as well as the potential risks it poses. Document your requirements and request prospective vendors to address each item directly https://www.isaca.org/resources/news-and-trends/isaca-now-blog/2019/third-party-vendor-selection-if-done-right-its-a-win-win

Before evaluating vendors or analyzing risks, it's crucial to understand what the organization's specific security needs and expectations are

Defining information security requirements and processes should be the initial step to ensure that the organization's specific security needs are understood and can serve as a foundation for subsequent activities such as risk analysis, benchmarking, and vendor assessment

Define what you need, then select the most suitable one based on your needs and expectations.

A ) First Review then define

C. Define information security requirements and processes.

FIRST he needs to define the security requirements and processes relative to the new SaaS and then he can review reports based on these requirements to see if vendors comply.

"Selecting a vendor" : C

I think C