Exam CISM topic 1 question 214 discussion

Right to Audit.

In the "CISM Review Manual 15th Edition" by ISACA, it is stated in Domain 4: Incident Management and Response, that continuous monitoring is a critical part of the overall incident management process, and it extends to monitoring third-party providers to ensure they meet the organization's security requirements.

Continuous monitoring provides the BEST assurance that a third-party provider is actively meeting security requirements on an ongoing basis, not just at a point in time. It allows for: • Real-time visibility into compliance and risk posture • Proactive detection of control failures or vulnerabilities • Ensuring service-level and security-level agreements are being upheld • Early response to changes in the third party’s environment

ConMon involves regularly checking a vendor's security posture, including their compliance with regulations, security controls in place, and any changes made to their systems.

In the "CISM Review Manual 15th Edition" by ISACA, it is stated in Domain 4: Incident Management and Response, that continuous monitoring is a critical part of the overall incident management process, and it extends to monitoring third-party providers to ensure they meet the organization's security requirements.

Continuous versus periodic verification --> Continuous will always be better

C. Right-to-audit clause in the contract

Right-to-audit clause can include continuous monitoring. Audit =/= periodic (people get stuck with this). It's like you enable auditing of specific action or a file system in the OS. It's not periodic, it's constant (and you can call it continuous monitoring).

To be frank A is the best answer. Continuous versus periodic verification --> Continuous will always be better A is better than C. Answer is --> A

If someone read this. When do we use "Right to Audit"?

I understand that audit and assurance go hand in hand. However, if we have to pick between audit and continuous monitoring, I'd pick monitoring. Audit will provide the snapshot of the state of security at a specific time, which can change post audit. Continuous monitoring will be required for ongoing assurance. Answer: A

C. Right-to-audit clause in the contract

C may be wrong because the audit will not happen not so frequently, hence making sure assurance all time is not possible

i vote .....C. Right-to-audit clause in the contract

A for sure, it's the only method to assure while audit can not since vendor can alter controls after the audit is closed. Besides, continuous monitoring generally performs after an audit or security assessment, why it is called "continuous monitoring" but not just "monitoring"

Auditoría siempre como principio de SLA

Continuous monitoring helps in ongoing oversight, but it may not cover all aspects of security requirements. Due diligence questionnaires provide initial information, but they may not be sufficient to validate the provider's security practices comprehensively. Performance metrics can indicate the provider's performance but may not directly address security requirements.