CAS-005 · Question #191
A Chief Information Security Officer (CISO) is developing a third-party risk management program and wants to establish an order of preference for solicitation and acceptance of audit and assessment…
The correct answer is A. Certifications are typically issued against a formal standard. A CISO prefers formal certifications because they are based on independent audits against established, rigorous frameworks or standards, providing a higher level of objective assurance compared to self-attestations.
Question
A Chief Information Security Officer (CISO) is developing a third-party risk management program and wants to establish an order of preference for solicitation and acceptance of audit and assessment results from business partners. The CISO prefers a formal certification against an established framework, which should be considered more reliable than self-attestations. Which of the following is most likely the reason for this perspective?
Options
- ACertifications are typically issued against a formal standard.
- BAssessments are based on evidence, not judgments.
- CFor standards like PCI, self-attestations are more reliable than certifications.
- DA certification audit is managed by a central authority.
How the community answered
(36 responses)- A86% (31)
- B3% (1)
- C8% (3)
- D3% (1)
Why each option
A CISO prefers formal certifications because they are based on independent audits against established, rigorous frameworks or standards, providing a higher level of objective assurance compared to self-attestations.
Formal certifications are preferred over self-attestations because they are typically issued by an independent third party after verifying an organization's compliance with a recognized and rigorous formal standard or framework, providing objective and reliable assurance.
While assessments, including certifications, should be evidence-based, the key differentiator for reliability is the independent verification against a standard, not merely the presence of evidence.
This statement is incorrect; for standards like PCI DSS, independent certifications (e.g., RoC by a QSA) are generally considered more reliable and provide greater assurance than self-attestations (SAQs).
While standards are defined by authorities, certification audits are conducted by accredited third-party bodies, not necessarily by a single 'central authority' that directly manages every individual audit.
Concept tested: Third-party risk management and audit assurance
Source: https://learn.microsoft.com/en-us/compliance/regulatory/offering-soc-2
Community Discussion
No community discussion yet for this question.