3 Flashcards
- Which of the following BEST supports effective communication during information security incidents7
A. Frequent incident response training sessions
B. Centralized control monitoring capabilities
C. Responsibilities defined within role descriptions
D. Predetermined service level agreements (SLAs)
Answer: D
Explanation: The best way to support effective communication during information security incidents is to
have predetermined service level agreements (SLAs) because they define the expectations and
responsibilities of the parties involved in the incident response process, and specify the communication
channels, methods, and frequency for reporting and updating on the incident status and resolution.
Frequent incident response training sessions are not very effective because they do not address the
communication needs or challenges during an actual incident. Centralized control monitoring capabilities
are not very effective because they do not address the communication needs or challenges during an
actual incident. Responsibilities defined within role descriptions are not very effective because they do not
address the communication needs or challenges during an actual incident. References:
https://www.isac
A.org/resources/isaca-journal/issues/2017/volume- 5/incident-response-lessons-learned
https://www.isac
A.org/resources/isaca- journal/issues/2018/volume-3/incident-response-lessons-learned
- Which of the following presents the GREATEST challenge to a large multinational organization using an
automated identity and access management (1AM) system?
A. Staff turnover rates that significantly exceed industry averages
B. Large number of applications in the organization
C. Inaccurate workforce data from human resources (HR)
D. Frequent changes to user roles during employment
Answer: C
- Which of the following is the MOST important input to the development of an effective information security
strategy?
A. Risk and business impact assessments
B. Business processes and requirements
C. Current and desired state of security
D. Well-defined security policies and procedures
Answer: B
- What should be the NEXT course of action when an information security manager has identified a
department that is repeatedly not following the security policy?
A. Perform a vulnerability assessment on the systems within the department.
B. Introduce additional controls to force compliance with policy.
C. Require department users to repeat security awareness training.
D. Report the policy violation to senior management.
Answer: D
- An organization experienced a loss of revenue during a recent disaster. Which of the following would BEST
prepare the organization to recover?
A. Business impact analysis (BIA)
B. Business continuity plan (BCP)
C. Incident response plan
D. Disaster recovery plan (DRP)
Answer: B
- The PRIMARY goal to a post-incident review should be to:
A. identify policy changes to prevent a recurrence.
B. determine how to improve the incident handling process.
C. establish the cost of the incident to the business.
D. determine why the incident occurred.
Answer: B
Explanation: The primary goal of a post-incident review is to identify areas for improvement in the incident
handling process. The focus is on evaluating the effectiveness of incident response procedures, technical
controls, communication channels, coordination among teams, documentation, and any other relevant
aspects. The post-incident review should also provide recommendations for corrective actions, preventive
measures, and lessons learned that can help reduce the likelihood and impact of future
incidents12. References = CISM Review Manual 15th Edition, page 1251; CISM Item Development Guide,
page 72
- An information security team must obtain approval from the information security steering committee to
implement a key control. Which of the following is the MOST important input to assist the committee in
making this decision?
A. IT strategy
B. Security architecture
C. Business case
D. Risk assessment
Answer: C
- When management changes the enterprise business strategy which of the following processes should be
used to evaluate the existing information security controls as well as to select new information security
controls?
A. Configuration management
B. Risk management
C. Access control management
D. Change management
Answer: D
Explanation: According to the CISM Review Manual (Digital Version), Chapter 3, Section 3.2.2, change
management is the process of identifying, assessing, approving, implementing, and monitoring changes to
information systems and information security controls1. Change management is essential for ensuring that
changes are aligned with the organization’s business strategy and objectives, as well as complying with
applicable laws and regulations1.
The CISM Review Manual (Digital Version) also states that change management should be performed in
conjunction with other processes, such as configuration management, access control management, and
risk management1. Configuration management is the process of identifying, documenting, controlling, and
verifying the configuration items (CIs) of an information system1. Access control management is the
process of granting or denying access to information systems and information assets based on predefined
policies and procedures1. Risk management is the process of identifying, analyzing, evaluating, treating,
monitoring, and communicating risks to information systems and information assets1.
The CISM Exam Content Outline also covers the topic of change management in Domain 3
— Information Security Program Development and Management (27% exam weight)2. The subtopics
include:
✑ 3.2.2 Change Management
✑ 3.2.3 Change Control
✑ 3.2.4 Change Implementation
✑ 3.2.5 Change Monitoring
I hope this answer helps you prepare for your CISM exam. Good luck!
- Which of the following defines the MOST comprehensive set of security requirements for a newly
developed information system?
A. Risk assessment results
B. Audit findings
C. Key risk indicators (KRIs)
D. Baseline controls
Answer: D
Explanation: Baseline controls are the minimum set of security requirements that apply to all information
systems in an organization, regardless of their specific functions or characteristics. They are derived from
the organization’s security policies, standards, and best practices, and they reflect the organization’s risk
appetite and tolerance. Baseline controls provide a consistent and comprehensive foundation for the
security of the information systems, and they can be tailored or supplemented by additional controls as
needed for specific systems or situations. The other options are not as comprehensive as baseline controls,
as they may only address certain aspects or aspects of the security requirements, or they may vary
depending on the system or the context. For example, risk assessment results are an important input for
defining the security requirements, but they are not the requirements themselves. Audit findings are an
output of evaluating the compliance and effectiveness of the security requirements, but they are not the
requirements themselves. Key risk indicators (KRIs) are metrics that measure the level of risk exposure and
performance of the security requirements, but they are not the requirements themselves. References =
✑ CISM Review Manual 15th Edition, page 113: “Baseline controls are the minimum security requirements
that apply to all systems within the organization.”
✑ CISM Review Questions, Answers & Explanations Database - 12 Month Subscription, question 478:
“Baseline controls are the minimum security requirements that apply to all systems within the organization.
They are derived from the organization’s security policies, standards, and best practices, and they reflect
the organization’s risk appetite and tolerance.”
- Which of the following is the BEST approach for data owners to use when defining access privileges for
users?
A. Define access privileges based on user roles.
B. Adopt user account settings recommended by the vendor.
C. Perform a risk assessment of the users’ access privileges.
A. Implement an identity and access management (IDM) tool.
Answer: A
Explanation: This approach is the best because it ensures that users have the minimum level of access
required to perform their job functions, which reduces the risk of unauthorized access or misuse of dat
A.
User roles are defined based on the business needs and responsibilities of the users, and they can be
easily managed and audited. References: The CISM Review Manual 2023 states that “the data owner is
responsible for defining the access privileges for each user role” and that “the data owner should ensure
that the principle of least privilege is applied to all users” (p. 82). The CISM Review Questions, Answers &
Explanations Manual 2023 also provides the following rationale for this Answer “Defining access privileges
based on user roles is the best approach because it allows the data owner to assign the minimum level of
access required for each role and to review and update the roles periodically” (p. 23).
- A security incident has been reported within an organization. When should an information security manager
contact the information owner?
A. After the incident has been contained
B. After the incident has been mitigated
C. After the incident has been confirmed
D. After the potential incident has been logged
Answer: C
Explanation: The information owner is the person who has the authority and responsibility for the
information asset and its protection. The information security manager should contact the information
owner as soon as possible after the incident has been confirmed, to inform them of the incident, its impact,
and the actions taken or planned to resolve it. The information owner may also need to be involved in the
decision-making process regarding the incident response and recovery. (From CISM Review Manual 15th
Edition)
References: CISM Review Manual 15th Edition, page 191, section 4.3.4.1.
- Which of the following BEST enables an organization to maintain an appropriate security control
environment?
A. Alignment to an industry security framework
B. Budgetary support for security
C. Periodic employee security training
D. Monitoring of the threat landscape
Answer: A
Explanation: Alignment to an industry security framework ensures that the organization adopts best
practices and standards for security control implementation and maintenance. References = CISM Review
Manual, 16th Edition, Domain 1: Information Security Governance, Chapter 1: Establish and Maintain an
Information Security Strategy, Section: Information Security Frameworks
- An information security manager wants to document requirements detailing the minimum security controls
required for user workstations. Which of the following resources would be MOST appropriate for this
purposed?
A. Guidelines
B. Policies
C. Procedures
D. Standards
Answer: D
Explanation: Standards are detailed statements of the minimum requirements for hardware, software, or
security configurations. They are used to define the minimum security controls required for user
workstations. References = CISM Review Manual, 16th Edition, page 69.
- Which of the following should be done FIRST when developing a business continuity plan (BCP)?
A. Review current recovery policies.
B. Define the organizational strategy.
C. Prioritize the critical processes.
D. Review existing cyber insurance coverage.
Answer: B
- When analyzing the emerging risk and threat landscape, an information security manager should FIRST:
A. determine the impact if threats materialize.
B. determine the sources of emerging threats.
C. review historical threats within the industry.
D. map threats to business assets.
Answer: B
- An organization has acquired a new system with strict maintenance instructions and schedules. Where
should this information be documented?
A. Standards
B. Policies
C. Guidelines
D. Procedures
Answer: D
Explanation:
Procedures are the detailed steps or instructions for performing specific tasks or activities. They are usually
aligned with standards, policies and guidelines, but they are more specific and prescriptive. System
maintenance instructions and schedules are examples of procedures that should be documented and
followed to ensure the proper functioning and security of the system.
References: The CISM Review Manual 2023 defines procedures as “the lowest level in the hierarchy of
documentation. They are detailed steps that a user must follow to accomplish an activity” (p. 80). The CISM
Item Development Guide also provides the following explanation for this Answer “Procedures are the
correct answer because they provide the specific steps to be followed to maintain the system” (p. 11).
- Which of the following is the PRIMARY responsibility of the information security function when an
organization adopts emerging technologies?
A. Developing security training for the new technologies
B. Designing new security controls
C. Creating an acceptable use policy for the technologies
D. Assessing the potential security risk
Answer: D
Explanation: The primary responsibility of the information security function when an organization adopts
emerging technologies is to assess the potential security risk, which means identifying and evaluating the
threats, vulnerabilities, and impacts that the new technologies may pose to the organization’s data, systems,
and objectives. Assessing the potential security risk helps the information security function to determine the
appropriate security requirements, controls, and measures to mitigate the risk and ensure the safe and
secure adoption of the emerging technologies.
References = Performing Risk Assessments of Emerging Technologies, CISM Review Manual 15th Edition
Learn more: 1. isac
A.org2. isac
A.org3. niccs.cis
A.gov4. venturebeat.com 10of30
An organization is planning to outsource network management to a service provider. Including which of the
following in the contract would be the MOST effective way to mitigate information security risk?
A.
Requirement for regular information security awareness B. Right-to-audit clause C. Service level
agreement (SLA) D. Requirement to comply with corporate security policy Answer (Refer to the Information
Security Manager® (CISM®) documents and learning resources by ISACA available at
https://store.isac
A.org/s/store#/store/browse/cat/a2D4w00000Ac6NNEAZ/tiles to verify the answer of the
following questions very carefully.) Use the following format please:
Verified Answer = (From CISM Manual or related resources) Very Short Explanation
= (From CISM Manual or related resources) References = (From CISM Manual or related resources)
=========================
- Which of the following is the MOST essential element of an information security program?
A. Benchmarking the program with global standards for relevance
B. Prioritizing program deliverables based on available resources
C. Involving functional managers in program development
D. Applying project management practices used by the business
Answer: C
Explanation:
Involving functional managers in program development is the most essential element of an information
security program, because they are responsible for ensuring that the information security policies,
standards, and procedures are implemented and enforced within their respective business units. They also
provide input and feedback on the information security requirements, risks, and controls that affect their
operations and objectives.
References =
CISM Review Manual, 16th Edition, ISACA, 2020, p. 37: “Functional managers are responsible for ensuring
that the information security policies, standards, and procedures are implemented and enforced within their
respective business units.”
CISM Review Manual, 16th Edition, ISACA, 2020, p. 38: “Functional managers should be involved in the
development of the information security program to provide input and feedback on the information security
requirements, risks, and controls that affect their operations and objectives.”
- Which of the following is the BEST indication of an effective disaster recovery planning process?
A. Hot sites are required for any declared disaster.
B. Chain of custody is maintained throughout the disaster recovery process.
C. Post-incident reviews are conducted after each event.
D. Recovery time objectives (RTOs) are shorter than recovery point objectives (RPOs).
Answer: C
- In a cloud technology environment, which of the following would pose the GREATEST challenge to the
investigation of security incidents?
A. Access to the hardware
B. Data encryption
C. Non-standard event logs
D. Compressed customer data
Answer: C
- For event logs to be acceptable for incident investigation, which of the following is the MOST important
consideration to establish chain of evidence?
A. Centralized logging
B. Time clock synchronization
C. Available forensic tools
D. Administrator log access
Answer: B
- Which of the following is the MOST important consideration when developing key
performance indicators (KPIs) for the information security program?
A. Alignment with financial reporting
B. Alignment with business initiatives
C. Alignment with industry frameworks
D. Alignment with risk appetite
Answer: B
Explanation:
Explore
The most important consideration when developing key performance indicators (KPIs) for the information
security program is B. Alignment with business initiatives. This is because KPIs are measurable values that
demonstrate how effectively the information security program is achieving its objectives and delivering
value to the organization. KPIs should be aligned with the business initiatives, such as the strategic goals,
the mission, the vision, and the values of the organization, and support the achievement of the desired
outcomes and benefits. KPIs should also reflect the needs, expectations, and challenges of the business
stakeholders, and provide relevant, meaningful, and actionable information for decision making and
improvement. KPIs should not be too technical, complex, or ambiguous, but rather focus on the key
aspects of information security performance, such as risk, compliance, maturity, value, and effectiveness.
KPIs are measurable values that demonstrate how effectively the information security program is achieving
its objectives and delivering value to the organization. KPIs should be aligned with the business initiatives,
such as the strategic goals, the mission, the vision, and the values of the organization, and support the
achievement of the desired outcomes and benefits. (From CISM Manual or related resources)
References = CISM Review Manual 15th Edition, Chapter 1, Section 1.3.2, page 281; CISM Domain –
Information Security Program Development | Infosec2; KPIs in Information Security: The 10 Most Important
Security Metrics3
- Which of the following is MOST important to ensuring that incident management plans are
executed effectively?
A. Management support and approval has been obtained.
B. The incident response team has the appropriate training.
C. An incident response maturity assessment has been conducted.
D. A reputable managed security services provider has been engaged.
Answer: A
- Which of the following is the PRIMARY reason to regularly update business continuity and disaster
recovery documents?
A. To enforce security policy requirements
B. To maintain business asset inventories
C. To ensure audit and compliance requirements are met
D. To ensure the availability of business operations
Answer: D
Explanation:
The primary reason to regularly update business continuity and disaster recovery documents is to ensure
that the plans and procedures are aligned with the current business needs and objectives, and that they
can effectively support the availability of business operations in the event of a disaster. Updating the
documents also helps to enforce security policy requirements, maintain business asset inventories, and
ensure audit and compliance requirements are met, but these are secondary benefits.
References = CISM Review Manual, 16th Edition eBook1, Chapter 9: Business Continuity and Disaster
Recovery, Section: Business Continuity Planning, Subsection: Business Continuity Plan Maintenance,
Page 378.
- Which of the following is the MOST effective way to ensure the security of services and solutions delivered
by third-party vendors?
A. Integrate risk management into the vendor management process.
B. Conduct security reviews on the services and solutions delivered.
C. Review third-party contracts as part of the vendor management process.
D. Perform an audit on vendors’ security controls and practices.
Answer: A
Explanation:
Integrating risk management into the vendor management process is the most effective way to ensure the
security of services and solutions delivered by third-party vendors, as it enables the organization to identify,
assess, treat, and monitor the risks associated with outsourcing. Risk management should be applied
throughout the vendor life cycle, from selection, contracting, onboarding, monitoring, to termination. Risk
management also helps the organization to define the security requirements, expectations, and
responsibilities for the vendors, and to evaluate their performance and compliance. (From CISM Review
Manual 15th Edition)
References: CISM Review Manual 15th Edition, page 184, section 4.3.3.2; Preparing Your First Supplier
Audit Plan1.
- Which of the following BEST enables the assignment of risk and control ownership?
A. Aligning to an industry-recognized control framework
B. Adopting a risk management framework
C. Obtaining senior management buy-in
D. Developing an information security strategy
Answer: C
Explanation: Obtaining senior management buy-in is the best way to enable the assignment of risk and
control ownership because it helps to establish the authority and accountability of the risk and control
owners, as well as to provide them with the necessary resources and support to perform their roles. Risk
and control ownership refers to the assignment of specific responsibilities and accountabilities for managing
risks and controls to individuals or groups within the organization. Obtaining senior management buy-in
helps to ensure that risk and control ownership is aligned with the organizational objectives, structure, and
culture, as well as to communicate the expectations and benefits of risk and control ownership to all
stakeholders. Therefore, obtaining senior management buy-in is the correct answer.
References:
✑ https://www.protechtgroup.com/en-au/blog/risk-control-management
✑
https://www.mckinsey.com/~/media/mckinsey/dotcom/client_service/risk/working%20papers/23_getting_ris
k_ownership_right.ashx
✑ https://www.linkedin.com/pulse/risk-controls-who-owns-them-david-tattam
- Following an employee security awareness training program, what should be the expected outcome?
A. A decrease in the number of viruses detected in incoming emails
B. A decrease in reported social engineering attacks
C. An increase in reported social engineering attempts
D. An increase in user-reported false positive incidents
Answer: C
Explanation:
This outcome indicates that the employees are more aware of the signs and techniques of social
engineering and are able to report them to the appropriate authorities. This also helps to prevent successful
attacks and reduce the impact of potential breaches. References: The CISM Review Manual 2023 states
that “security awareness training should include information on how to identify and report social engineering
attempts” and that “the effectiveness of security awareness training can be measured by the number and
quality of reported incidents” (p. 121). The CISM Review Questions, Answers & Explanations Manual 2023
also provides the following rationale for this Answer “An increase in reported social engineering attempts is
the best indicator that the security awareness training program has been effective, as it shows that the
employees are more vigilant and proactive in detecting and reporting such attempts” (p. 45).
- A KEY consideration in the use of quantitative risk analysis is that it:
A. aligns with best practice for risk analysis of information assets.
B. assigns numeric values to exposures of information assets.
C. applies commonly used labels to information assets.
D. is based on criticality analysis of information assets.
Answer: B
Explanation: A key consideration in the use of quantitative risk analysis is that it assigns numeric values to
exposures of information assets, such as the probability of occurrence, the frequency of occurrence, the
impact of occurrence, and the monetary value of the assets. These numeric values help to measure and
compare the risks in a more objective and consistent way, and to support the decision-making process
based on cost-benefit analysis. Quantitative risk analysis also requires reliable and accurate data sources,
and it may involve the use of statistical tools and techniques.
References = CISM Review Manual, 16th Edition eBook1, Chapter 2: Information Risk Management,
Section: Risk Analysis, Subsection: Quantitative Risk Analysis, Page 84.
- A newly appointed information security manager has been asked to update all security- related policies and
procedures that have been static for five years or more. What should be done NEXT?
A. Update in accordance with the best business practices.
B. Perform a risk assessment of the current IT environment.
C. Gain an understanding of the current business direction.
D. Inventory and review current security policies.
Answer: D
Explanation: The next step for the information security manager should be to inventory and review the
current security policies to understand the existing security requirements, controls, and gaps. This will help
to identify the areas that need to be updated, revised, or replaced to align with the current business needs
and objectives, as well as the legal and regulatory requirements. Updating the policies in accordance with
the best business practices, performing a risk assessment of the current IT environment, or gaining an
understanding of the current business direction are important activities, but they should be done after
reviewing the current security policies.
References = CISM Review Manual, 16th Edition eBook1, Chapter 1: Information Security Governance,
Section: Information Security Policies, Standards, Procedures and Guidelines, Subsection: Information
Security Policies, Page 28.
- An employee of an organization has reported losing a smartphone that contains sensitive information The
BEST step to address this situation is to:
A. disable the user’s access to corporate resources.
B. terminate the device connectivity.
C. remotely wipe the device
D. escalate to the user’s management
Answer: C
Explanation:
The best step to address the situation of losing a smartphone that contains sensitive information is to
remotely wipe the device, which means erasing all the data on the device and restoring it to factory settings.
Remotely wiping the device can prevent unauthorized access to the sensitive information and protect the
organization from data breaches or leaks. Remotely wiping the device can be done through services such
as Find My Device for Android or Find My iPhone for iOS, or through mobile device management (MDM)
solutions. The other options, such as disabling the user’s access, terminating the device connectivity, or
escalating to the user’s management, may not be effective or timely enough to secure the sensitive
information on the device. References:
✑ https://www.security.org/resources/protect-data-lost-device/
✑ https://support.google.com/android/answer/6160491?hl=en
✑ https://www.pcmag.com/how-to/locate-lock-erase-how-to-find-lost-android-phone
- Which of the following should an information security manager do FIRST upon confirming a privileged
user’s unauthorized modifications to a security application?
A. Implement compensating controls to address the risk.
B. Report the risk associated with the policy breach.
C. Implement a privileged access management system.
D. Enforce the security configuration and require the change to be reverted.
Answer: D
Explanation: The first step in handling unauthorized modifications to a security application is to assess the
problems and institute rollback procedures, if needed. This will ensure that the security application is
restored to its original state and prevent further damage or exploitation. The other options are possible
actions to take after the rollback, but they are not the first priority.
References = Protect, Detect and Correct Methodology to Mitigate Incidents: Insider Threats (section: The
Insider Threat)
- An organization plans to leverage popular social network platforms to promote its products and services.
Which of the following is the BEST course of action for the information security manager to support this
initiative?
A. Establish processes to publish content on social networks.
B. Assess the security risk associated with the use of social networks.
C. Conduct vulnerability assessments on social network platforms.
D. Develop security controls for the use of social networks.
Answer: B
Explanation: The best course of action for the information security manager to support the initiative of
leveraging popular social network platforms to promote the organization’s products and services is to
assess the security risk associated with the use of social networks. Security risk assessment is a process of
identifying, analyzing, and evaluating the potential threats and vulnerabilities that may affect the
confidentiality, integrity, and availability of information assets and systems. By conducting a security risk
assessment, the information security manager can provide valuable input to the decision-making process
regarding the benefits and costs of using social networks, as well as the appropriate security controls and
mitigation strategies to reduce the risk to an acceptable level. The other options are not the best course of
action, although they may be part of the security risk management process. Establishing processes to
publish content on social networks is an operational task that should be performed after assessing the
security risk and implementing the necessary controls. Conducting vulnerability assessments on social
network platforms is a technical activity that may not be feasible or effective, as the organization does not
have control over the platforms’ infrastructure and configuration. Developing security controls for the use of
social networks is a preventive measure that should be based on the results of the security risk assessment
and aligned with the organization’s risk appetite and tolerance
- Which of the following should be the NEXT step after a security incident has been reported?
A. Recovery
B. Investigation
C. Escalation
D. Containment
Answer: D
- To effectively manage an organization’s information security risk, it is MOST important to:
A. assign risk management responsibility to an experienced consultant.
B. periodically identify and correct new systems vulnerabilities.
C. establish and communicate risk tolerance.
D. benchmark risk scenarios against peer organizations.
Answer: C
Explanation:
To effectively manage an organization’s information security risk, it is most important to establish and
communicate risk tolerance, which is the level of risk that the organization is willing to accept or bear. By
establishing and communicating risk tolerance, the organization can align its risk management strategy and
objectives with its business goals and values, and ensure that the risk management activities and decisions
are consistent and appropriate across the organization.
References: The CISM Review Manual 2023 defines risk tolerance as “the acceptable level of variation that
management is willing to allow for any particular risk as the enterprise pursues its objectives” and states
that “the information security manager should assist the enterprise in establishing and communicating its
risk tolerance, and ensure that the risk management process is aligned with the enterprise’s risk tolerance”
(p. 94). The CISM Review Questions, Answers & Explanations Manual 2023 also provides the following
rationale for this Answer “Establish and communicate risk tolerance is the correct answer because it is the
most important factor to effectively manage an organization’s information security risk, as it helps to define
the scope, direction, and priorities of the risk management process, and to ensure that the risk
management activities and decisions are consistent and appropriate across the organization” (p. 29).
Additionally, the article Risk Tolerance: The Forgotten Factor from the ISACA Journal 2019 states that “risk
tolerance is the key factor that influences the risk management process and outcomes” and that “risk
tolerance should be established and communicated by the organization’s senior management and board of
directors, and should reflect the organization’s strategy, culture, and governance” (p. 1)1
- What should be the FIRST step when implementing data loss prevention (DLP) technology?
A. Perform due diligence with vendor candidates.
B. Build a business case.
C. Classify the organization’s dat
A.
D. Perform a cost-benefit analysis.
Answer: C
- An organization has decided to outsource IT operations. Which of the following should be the PRIMARY
focus of the information security manager?
A. Security requirements are included in the vendor contract
B. External security audit results are reviewed.
C. Service level agreements (SLAs) meet operational standards.
D. Business continuity contingency planning is provided
Answer: A
Explanation:
Security requirements are included in the vendor contract is the primary focus of the information security
manager when outsourcing IT operations because it ensures that the vendor is legally bound to comply with
the client’s security policies and standards, as well as any external regulations or laws. This also helps to
define the roles and responsibilities of both parties, the security metrics and controls to be used, and the
penalties for non- compliance or breach. Therefore, security requirements are included in the vendor
contract is the correct answer.
References:
✑ https://www.techtarget.com/searchsecurity/tip/15-benefits-of-outsourcing-your-cybersecurity-operations
✑ https://www.sciencedirect.com/science/article/pii/S0378720616302166
- Recommendations for enterprise investment in security technology should be PRIMARILY based on:
A. adherence to international standards
B. availability of financial resources
C. the organization s risk tolerance
D. alignment with business needs
Answer: C
Explanation: Verified Answer According to the CISM Review Manual, 15th Edition, Chapter 3, Section
3.2.1.1, Recommendations for enterprise investment in security technology should be primarily based on
the organization’s risk tolerance.1 Comprehensive and Detailed
Explanation: The organization’s risk tolerance is the degree of uncertainty that the organization is willing to
accept in order to pursue its objectives. It reflects the organization’s appetite for risk and its ability to cope
with potential losses or disruptions. The higher the risk tolerance, the more aggressive and innovative the
security investments can be, as they can help achieve faster growth or competitive advantage. The lower
the risk tolerance, the more conservative and defensive the security investments should be, as they can
help protect the organization’s assets and reputation from potential threats.
References: 1: CISM Review Manual, 15th Edition, Chapter 3, Section 3.2.1.1
- The MOST important element in achieving executive commitment to an information security governance
program is:
A. a defined security framework.
B. a process improvement model
C. established security strategies.
D. identified business drivers.
Answer: D
Explanation: The most important element in achieving executive commitment to an information security
governance program is to align the program with the identified business drivers of the organization.
Business drivers are the factors that influence the strategic objectives, goals, and priorities of the
organization. They reflect the needs and expectations of the stakeholders, customers, regulators, and other
parties that are relevant to the organization’s mission and vision. By aligning the information security
governance program with the business drivers, the executive can demonstrate the value and benefits of
information security to the organization’s performance, reputation, and competitiveness. The other options
are not the most important element, although they may be part of an information security governance
program. A defined security framework is a set of standards, guidelines, and best practices that provide a
structure and direction for implementing information security. A process improvement model is a
methodology that helps to identify, analyze, and improve the processes related to information security.
Established security strategies are the plans and actions that define how information security supports and
enables the business objectives and goals. These elements are important for developing and executing an
information security governance program, but they do not necessarily ensure executive commitment unless
they are aligned with the business drivers
- Which of the following is the BEST indication that an organization has integrated information security
governance with corporate governance?
A. Security performance metrics are measured against business objectives.
B. Impact is measured according to business loss when assessing IT risk.
C. Security policies are reviewed whenever business objectives are changed.
D. Service levels for security vendors are defined according to business needs.
Answer: A
Explanation:
Security performance metrics are quantitative or qualitative measures that indicate the effectiveness and
efficiency of the information security program in achieving the organization’s security goals and objectives.
Measuring security performance metrics against business objectives is the best indication that an
organization has integrated information security governance with corporate governance, as it demonstrates
that the security program is aligned with and supports the business strategy, value delivery, and risk
management. (From CISM Review Manual 15th Edition)
References: CISM Review Manual 15th Edition, page 37, section 1.3.2.2.
- Senior management recently approved a mobile access policy that conflicts with industry best practices.
Which of the following is the information security manager’s BEST course of action when developing
security standards for mobile access to the organization’s network?
A. Align the standards with the organizational policy.
B. Align the standards with industry best practices.
C. Resolve the discrepancy before developing the standards.
D. Perform a cost-benefit analysis of aligning the standards to policy.
Answer: C
Explanation: The Information Security Manager’s primary responsibility is to ensure that the organization’s
information assets are adequately protected. In this scenario, there is a conflict between the approved
mobile access policy and industry best practices. Developing security standards based on a flawed policy
could lead to significant security vulnerabilities.
Why the other options are not the best course of action:
✑
A. Align the standards with the organizational policy: This would perpetuate the misalignment with best
practices, potentially leaving the organization exposed to risks.
✑ B. Align the standards with industry best practices: While this is ideal from a
security perspective, it directly contradicts the approved policy, which could create operational and
compliance issues.
✑ D. Perform a cost-benefit analysis of aligning the standards to policy: A costbenefit
analysis might be useful at some point, but it does not address the fundamental issue of a policy that
is not in line with best practices.
Key CISM Principles Reflected:
✑ Alignment with Organizational Objectives: Security standards and policies should support and enable
the organization’s business objectives.
✑ Risk Management: Identifying, assessing, and mitigating risks are essential elements of information
security management.
✑ Governance: Effective governance ensures that information security activities are aligned with the
organization’s strategies and objectives.
In summary: The Information Security Manager should proactively engage senior management to highlight
the discrepancy between the approved policy and industry best practices. The goal is to revise the policy to
ensure it adequately addresses security risks while supporting the organization’s objectives. Once the
policy is aligned with best practices, the security standards can be developed accordingly.
