Exam CISM topic 1 question 239 discussion

The best indicator of the effectiveness of the vendor risk management process is an increase in the percentage of vendors that have completed a due diligence review. Due diligence review is an important aspect of vendor risk management. It involves evaluating a vendor's security practices, policies, and controls, as well as assessing their overall risk profile. By conducting thorough due diligence reviews, organizations can identify and mitigate potential risks associated with using a particular vendor.

An effective vendor risk management plan is characterized by its vendor due diligence policy. Vendor onboarding is one of the most delicate phases of a VRM program because it has a significant impact on an organization’s security posture. Poor onboarding practices will overlook the different types of risks and security vulnerabilities of new vendors, adding these risk to your risk profile. "https://www.upguard.com/blog/vendor-risk-management#:~:text=Vendor%20risk%20management%20is%20an,compliance%2C%20legal%20and%20regulatory%20risks."

Option B

The best indicator of the effectiveness of the vendor risk management process is an increase in the percentage of vendors with a completed due diligence review. This suggests that the organization is actively assessing and evaluating the risks associated with its vendors, which is a fundamental aspect of effective vendor risk management. Completing due diligence reviews helps ensure that vendors are meeting security and compliance requirements, reducing potential risks to the organization.

B - D could be a case of bad vendors selection

B - https://vendorcentric.com/single-post/vendor-due-diligence-reviews-an-important-tool-for-mitigating-risk/#:~:text=Vendor%20due%20diligence%20is%20a%20business%20discipline%20used,ethically%20sound%20and%20has%20an%20effective%20corporate%20structure.

D is the correct answer. Because if more breaches reported for the vendor, then can say that vendor not effectively manage their security programs.

option D, an increase in the percentage of vendors that have reported security breaches, suggests that the vendor risk management process is effectively identifying and capturing security incidents or breaches experienced by vendors. This indicates that the process has mechanisms in place to detect and respond to security issues, enabling timely remediation actions to be taken.

B. Increase in the percentage of vendors with a completed due diligence review

Clearly B

This is the best indicator. Since you already made sure all the controls and requirements are met.