Discuss Isaca CGEIT Exam Topic 5 Question 116

Which of the following BEST enables an enterprise to minimize the risks of intellectual property theft and loss of sensitive information when acquiring Internet of Things (IoT) hardware and software components?

AReview the data classification policy and relevant documentation

BTerminate contracts with suppliers from sanctioned regions of the world

CRequire nondisclosure agreements (NDAs) from all suppliers

DIntegrate supply chain cyber risk management processes

Suggested Answer: D

The best way to minimize intellectual property theft and sensitive information loss in IoT acquisitions is to integrate supply chain cyber risk management processes. This holistic approachincludes assessing supplier security posture, monitoring for threats, and ensuring cybersecurity is embedded into procurement, delivery, and operations.

NDAs, sanctions, and data classification are supportive, but only supply chain risk management addresses the full lifecycle risks and modern threats in globally sourced IoT ecosystems.

CGEIT Review Manual: Domain 4 -- Risk Optimization

COBIT 2019: DSS05 (Manage Security Services), APO10 (Manage Suppliers).

Get Premium CGEIT Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

21 comments · newest first

Beatriz 2 days ago

C could help, but it’s not enough on its own.

Glory 7 days ago

A is important too, but not as comprehensive as D.

Afton 12 days ago

I agree, D covers the whole supply chain.

Kaitlyn 17 days ago

I think D is the best choice. Cyber risk management is crucial.

Lauryn 23 days ago

I feel like A helps set the foundation for security.

Beatriz 28 days ago

NDAs are helpful, but they don't prevent all risks.

Omer 1 month ago

D really addresses the ongoing risks we face.

Lawrence 1 month ago

B seems too extreme, we need global suppliers.

Chantay 1 month ago

C is good for protecting info, but not enough on its own.

Jeanice 2 months ago

A is important too, but it’s more about internal policies.

Vincenza 2 months ago

I agree, D covers the whole supply chain.

Lettie 2 months ago

I think D is the best choice. Cyber risk management is crucial.

Verdell 2 months ago

Wait, are we really trusting NDAs to protect us? Sounds risky!

Sina 2 months ago

I actually think B could backfire, cutting off good suppliers.

Myra 2 months ago

A is important too, can't overlook data classification!

Junita 3 months ago

I’m not sure NDAs are enough, though.

Beula 3 months ago

Definitely D, supply chain cyber risk management is crucial!

Selma 3 months ago

Terminating contracts with suppliers from sanctioned regions seems extreme, but I guess it could help reduce risk. Still, I'm not sure if it's the best approach overall.

Shala 3 months ago

I feel like reviewing the data classification policy is important, but I’m not convinced it directly minimizes risks related to IoT components.

Markus 3 months ago

I remember practicing a question about NDAs, so option C might be a strong contender, but I wonder if it’s enough on its own.

Caprice 4 months ago

I think option D sounds familiar from our discussions on supply chain risks, but I'm not entirely sure if it's the best choice here.

Isaca CGEIT Exam - Topic 5 Question 116 Discussion