Certified: The ISACA CISA Prepcast

Welcome to The Bare Metal Cyber CISA Prepcast. This series helps you prepare for the exam with focused explanations and practical context.
Vendor management is one of the most critical areas of IT governance. Today’s organizations rely heavily on third-party providers for software, infrastructure, support, development, and business services. This reliance brings efficiency and expertise, but it also introduces risk. Vendors can fail to meet performance expectations, expose sensitive data, or cause compliance issues if not properly selected, monitored, and governed. Weak vendor controls are a leading cause of data breaches, system outages, and regulatory violations. Managing these relationships requires a structured approach, beginning with due diligence and extending through contract negotiation, service oversight, and exit planning. The CISA exam often includes questions that focus on vendor selection practices, contract language, and post-contract monitoring. Auditors are expected to evaluate whether third-party risks are understood, documented, and managed over the vendor lifecycle—not just at onboarding, but throughout the relationship.
Vendor selection begins with clearly defining the requirements of the project, service, or initiative in question. Organizations must understand what capabilities, support levels, and security controls they expect before seeking proposals. A formal request-for-proposal or request-for-quote process allows for structured evaluation and documentation. Selection criteria should include not just pricing or features, but the vendor’s financial health, technical capacity, compliance history, and reputation in the market. References and certifications such as ISO 27001 or a SOC 2 Type II report provide additional assurance. Risk factors such as data sensitivity, criticality to operations, and geographic considerations must be factored into the selection process. Auditors review whether selection procedures are followed consistently and whether documentation exists to support the final choice. On the CISA exam, expect scenarios where high-risk vendors are selected without proper due diligence, or where requirements are unclear, leading to downstream contract issues.
Once potential vendors are identified, a formal risk assessment is necessary. This assessment evaluates risks based on the type of service, the level of system or data access required, and the vendor’s role in business continuity. Vendors should be classified into tiers—such as low, moderate, or high risk—based on the impact of failure, data exposure, and service dependency. Higher-risk vendors should complete detailed security questionnaires or assessments, and internal stakeholders should review these findings before any agreements are signed. Considerations include legal jurisdiction, disaster recovery capabilities, cybersecurity posture, and past incidents. Auditors verify that vendor risk assessments are documented, reviewed, and approved as part of the onboarding process. CISA candidates should be able to evaluate risk classification criteria and understand how risk assessments influence contract terms, monitoring frequency, and resource allocation.
Contracts must clearly define expectations, responsibilities, and accountability. Essential elements include the scope of services, deliverables, performance standards, and timelines. Service level agreements and key performance indicators must be documented with clarity and enforceability. Data privacy, security, and confidentiality clauses are non-negotiable, especially when the vendor will access sensitive or regulated data. Contracts must also include breach notification timelines, incident reporting obligations, and the organization’s right to audit. Penalties for non-performance and clear termination conditions are required to protect the organization. Auditors examine whether contracts include these elements and whether they reflect the results of prior risk assessments. CISA exam scenarios may test your understanding of missing contract clauses, especially where operational or compliance issues later arise from vague or unenforceable terms.
Service level agreements and key performance indicators translate contract language into measurable commitments. SLAs must define specific targets, such as uptime percentages, response and resolution times, and availability windows. Performance measurement methods should be agreed upon, with standard reporting intervals and remediation terms. Escalation paths and penalties must be defined for service breaches. These metrics must also align with the organization's business needs and risk tolerance. For example, critical services may require faster recovery objectives or redundant systems. Auditors evaluate whether SLAs are realistic, monitored regularly, and enforced when vendors underperform. CISA candidates should expect to assess SLA completeness, understand how violations are reported and escalated, and identify where misalignment between business expectations and SLA terms creates risk.
Vendor onboarding is a control point often overlooked but essential to proper governance. Onboarding must include formal procedures for access provisioning, training, and risk acknowledgment. Vendors should receive only the access necessary to perform their work and should be required to sign non-disclosure agreements and comply with information security policies. Credentials should be temporary, limited in scope, and protected with multi-factor authentication. All vendor access must be logged and reviewed periodically. Auditors examine onboarding checklists, training confirmations, and access management reports to determine whether vendors are integrated securely. On the CISA exam, candidates should expect questions involving excessive or unmonitored vendor access, or scenarios where vendors remain active after their engagement ends due to poor offboarding controls.
Vendor relationships require continuous oversight—not just initial evaluation. Organizations must schedule periodic reviews of vendor performance, security posture, and compliance with SLAs. These reviews can take the form of scorecards, service dashboards, or governance meetings. Metrics such as service availability, incident frequency, and ticket response times provide insight into ongoing service health. Where issues are found—such as SLA breaches or audit findings—corrective actions must be documented, tracked, and verified. Auditors review whether vendor monitoring is consistent, whether performance reports are received and reviewed, and whether vendors are held accountable for meeting their commitments. CISA scenarios may involve unmonitored vendors whose poor performance leads to operational failures, and candidates will need to assess where oversight controls broke down.
Contract lifecycle management is often complex and must be tracked carefully. This includes tracking renewal dates, expiration timelines, amendment approvals, and version history. Contract changes—such as added services, adjusted pricing, or revised performance metrics—must go through formal approval workflows and be evaluated for compliance and risk implications. Contract management systems or shared document repositories should maintain current versions with audit trails. Auditors evaluate whether changes are documented, approved by appropriate stakeholders, and communicated to all relevant parties. CISA candidates may be tested on missed renewals, expired SLAs, or unauthorized contract changes that expose the organization to legal or performance risk. Contract lifecycle oversight is not just an administrative task—it is a key component of vendor governance.
Exit planning is another area where organizations often fall short. When a vendor relationship ends—whether due to expiration, termination, or replacement—there must be a plan to ensure business continuity and data security. This includes securing the return or destruction of data, recovering credentials and devices, and validating that access is fully revoked. Contracts should include exit clauses that outline these responsibilities. Transition plans must ensure that services are handed over smoothly, without service disruption or data loss. Continuity planning must consider the loss of critical vendors and define alternative arrangements. Auditors examine whether exit processes are documented, tested, and followed. CISA exam scenarios may present cases where vendor exits were mishandled, leading to lingering access or incomplete data recovery. Candidates must understand how to audit exit controls and evaluate whether third-party risk truly ends when the relationship does.
For CISA candidates, evaluating vendor selection and contract management involves a detailed review of both process and content. You must assess whether due diligence is performed during selection, whether risks are documented and managed, and whether contracts reflect performance, compliance, and security requirements. Expect exam questions on SLAs, contract clauses, onboarding procedures, and vendor monitoring. Strong vendor governance ensures that third-party value does not come with third-party exposure. Auditors help organizations extend accountability beyond their walls—verifying that outsourced relationships are subject to the same discipline, transparency, and control as internal operations. Whether reviewing a new cloud provider, a long-standing software vendor, or a strategic partner, the principles remain the same: define expectations, monitor performance, and maintain control at every stage of the relationship.
Thanks for joining us for this episode of The Bare Metal Cyber CISA Prepcast. For more episodes, tools, and study support, visit us at Baremetalcyber.com.