Exam CISM topic 1 question 323 discussion

A my dawg

I would go for A...

D. To ensure that clauses for periodic audits are included

Again i can see people just blindly going with Chatgpt lol. If you go with Chatgpt, Chatgpt initially said the correct answer is D. To ensure that clauses for periodic audits are included. However, when i explained the following to it, it changed it's answer and agreed with me: A. To perform a risk analysis on the outsourcing process is the correct answer i think. Ensuring that clauses for periodic audits are included during contract negotiation is in a sense part of performing risk analysis on the outsourcing process. A. is the better answer in my opinion. Chatgpt changed it's mind and agreed with me that A. To perform a risk analysis on the outsourcing process is the best answer. Keep in mind that the risk analysis encompasses the ensurance of clauses for periodic audits.

A. To perform a risk analysis on the outsourcing process While all the options may play a role in contract negotiations with service providers, performing a risk analysis on the outsourcing process is crucial. Information security managers need to assess the potential risks and security implications associated with outsourcing specific services or processes to third-party providers. This involves identifying potential vulnerabilities, evaluating the security measures in place at the service provider's end, and ensuring that the contract includes provisions to mitigate identified risks. The other options, while important, are not typically the primary responsibilities of the information security manager during contract negotiations

what if the service provider is not critical in terms of information security, e.g. a maintenance service for office cooling system, so why D? As a IS manager, action always guided by the risk, i.e. risk based approach, so A.

at the final stage of the contract we make sure the periodic audit clause is included.

D. To ensure that clauses for periodic audits are included

D. To ensure that clauses for periodic audits are included. The information security manager is responsible for ensuring that the contract with the service provider includes appropriate security measures to protect the organization's information assets. This may include clauses that require the service provider to undergo periodic security audits to ensure compliance with security standards, policies, and procedures. The information security manager may also work with legal and procurement teams to negotiate and include relevant security clauses in the contract to protect the organization's interests. Additionally, the information security manager may collaborate with other stakeholders to perform a risk analysis on the outsourcing process, obtain security standard certifications from the provider, and update security standards for the outsourced process as needed. However, ensuring that clauses for periodic audits are included is a key responsibility of the information security manager in contract negotiations with service providers to ensure that security requirements are met and maintained throughout the duration of the contract.

Ii go with D

Negotiation is finalizing, all done..just check for the contract details.

We are performing analysis during contract negotiation. Ensure important clause is more relevant. D is the correct answer in the context of contract negotiation.

pretty poor question... in finalising the agreement none of these are ideal in the last few stages....

A i guess