[References: The CISM Review Manual 2023 states that “the information security manager is responsible for ensuring that the security requirements and expectations for third-party products and services are defined, communicated, and enforced” and that “the information security manager should verify that the third parties have implemented adequate security controls and practices, and that they comply with applicable standards and regulations” (p. 138). The CISM Review Questions, Answers & Explanations Manual 2023 also provides the following rationale for this answer: “Increase in the percentage of vendors certified to a globally recognized security standard is the correct answer because it best indicates the effectiveness of the vendor risk management process, as it shows that the organization has established and enforced clear and consistent security requirements and expectations for its vendors, and that the vendors have demonstrated their compliance and commitment to security best practices” (p. 63). Additionally, the article Vendor Risk Management Demystified from the ISACA Journal 2015 states that “a globally recognized security standard provides a common language and framework for evaluating and improving the security posture and performance of vendors” and that “a vendor certification to a globally recognized security standard can help to reduce the risk of security breaches, increase the trust and confidence of customers and stakeholders, and enhance the reputation and competitiveness of the vendor” (p. 3, , , , , , , ]