Exam CISM topic 1 question 789 discussion

A - this ia a proactive approach. Ensures that security concerns are considered from the very beginning, during the decision-making process, rather than after a contract is already in place. C is more to reactive measure.

Audit is key here.

A. Integrate information security risk assessments into the procurement process. Integrating information security risk assessments into the procurement process is the most effective way to ensure that procurement decisions consider information security concerns. This approach involves evaluating the security aspects of SaaS solutions before they are procured and implemented.

A. Integrate information security risk assessments into the procurement process.

The tricky part in the question is "ensure". This means "ensuring the Procurement decision considers InfoSec and follow it's policies"; ideally this one will be ensured by audit.

A. Integrate information security risk assessments into the procurement process.

A. What they said. Integrate info sec risk assessment to procurement process.

I will go for A. Above explanation is correct.

A. Integrating information security risk assessments into the procurement process would be the MOST effective way to help ensure procurement decisions consider information security concerns. This approach would ensure that security risks are evaluated and considered during procurement, leading to more secure procurement decisions.