An organization engages a third-party vendor to monitor and support a financial application under scrutiny by regulators. Which of the following controls would MOST effectively manage risk to the…

The correct answer is A. Including penalty clauses for noncompliance in the vendor contract. When dealing with a third-party vendor supporting a financial application under regulatory scrutiny, the most effective way to manage risk is to ensure contractual enforcement of compliance requirements. Penalty clauses create a strong incentive for the vendor to meet…

Submitted by naveen.iyer· Apr 18, 2026Information Security Risk Management

Question

An organization engages a third-party vendor to monitor and support a financial application under scrutiny by regulators. Which of the following controls would MOST effectively manage risk to the organization?

Options

AIncluding penalty clauses for noncompliance in the vendor contract
BImplementing separation of duties between systems and data
CDisabling vendor access and only re-enabling when access is needed
DMonitoring key risk indicators (KRIs)

How the community answered

(30 responses)

A
83% (25)
B
10% (3)
C
3% (1)
D
3% (1)

Explanation

When dealing with a third-party vendor supporting a financial application under regulatory scrutiny, the most effective way to manage risk is to ensure contractual enforcement of compliance requirements. Penalty clauses create a strong incentive for the vendor to meet regulatory and security obligations. While monitoring KRIs and restricting access are useful controls, they do not provide the same level of enforceability and accountability as contractual

Topics

#Third-party risk management#Vendor contracts#Risk mitigation#Compliance

Community Discussion

No community discussion yet for this question.

Full CISM Practice