CISM 7 Flashcards
- Which of the following is MOST appropriate to communicate to senior management regarding information
risk?
A. Defined risk appetite
B. Emerging security technologies
C. Vulnerability scanning progress
D. Risk profile changes
Answer: D
Explanation:
The most appropriate information to communicate to senior management regarding information risk is the
risk profile changes, which reflect the current level and nature of the risks that the organization faces. The
risk profile changes can help senior management to understand the impact of the risks on the business
objectives, the effectiveness of the risk management strategy, and the need for any adjustments or
improvements. The risk profile changes can also help senior management to prioritize the allocation of
resources and to make informed decisions.
References = CISM Review Manual, 16th Edition eBook1, Chapter 2: Information Risk Management,
Section: Risk Communication, Subsection: Risk Reporting, Page 97.
- Which of the following is the PRIMARY purpose of a business impact analysis (BIA)?
A. To define security roles and responsibilities
B. To determine return on investment (ROI)
C. To establish incident severity levels
D. To determine the criticality of information assets
Answer: D
Explanation:
A business impact analysis (BIA) is a process that identifies and evaluates the potential effects of
disruptions to critical business operations as a result of a disaster, accident or emergency. The primary
purpose of a BIA is to determine the criticality of information assets and the impact of their unavailability on
the organization’s mission, objectives and reputation. (From CISM Review Manual 15th Edition)
References: CISM Review Manual 15th Edition, page 178, section 4.3.2.1.
- Which of the following should an information security manager do FIRST to address the risk associated
with a new third-party cloud application that will not meet organizational security requirements?
A. Update the risk register.
B. Consult with the business owner.
C. Restrict application network access temporarily.
D. Include security requirements in the contract.
Answer: B
Explanation: The information security manager should first consult with the business owner to understand
the business needs and objectives for using the new cloud application, and to discuss the possible
alternatives or compensating controls that can mitigate the risk. Updating the risk register, restricting
application network access, or including security requirements in the contract are possible actions to take
after consulting with the business owner.
References = CISM Review Manual, 16th Edition eBook1, Chapter 1: Information Security Governance,
Section: Risk Management, Subsection: Risk Treatment, Page 49.
- Which of the following is the BEST indication of a mature information security program?
A. Security incidents are managed properly.
B. Security spending is below budget.
C. Security resources are optimized.
D. Security audit findings are reduced.
Answer: C
Explanation:
A mature information security program is one that is aligned with the business strategy, objectives, and
culture, and that delivers value to the organization by effectively managing the information security risks
and enhancing the security posture. Optimizing the security resources means that the program uses the
available human, financial, and technical resources in the most efficient and effective way, and that it
continuously monitors and improves the performance and maturity of the security processes and controls.
References = CISM Review Manual 2022, page 331; CISM Exam Content Outline, Domain 1, Knowledge
Statement 1.22; What is a Mature Information Security Program?; How to Measure the Maturity of Your
Cybersecurity Program
- Meeting which of the following security objectives BEST ensures that information is protected against
unauthorized disclosure?
A. Integrity
B. Authenticity
C. Confidentiality
D. Nonrepudiation
Answer: C
Explanation: Confidentiality is the security objective that best ensures that information is
protected against unauthorized disclosure. Confidentiality means that only authorized parties can access or
view sensitive or classified information. Integrity means that information is accurate and consistent and has
not been tampered with or modified by unauthorized parties. Authenticity means that information is genuine
and trustworthy and has not been forged or misrepresented by unauthorized parties. Nonrepudiation
means that information can be verified and proven to be sent or received by a specific party without any
possibility of denial. References:
https://www.csoonline.com/article/3513899/the-cia-triad-definition-components-and- examples.html
- Which of the following BEST describes a buffer overflow?
A. A function is carried out with more data than the function can handle
B. A program contains a hidden and unintended function that presents a security risk
C. Malicious code designed to interfere with normal operations
D. A type of covert channel that captures data
Answer: A
Explanation: A buffer overflow is a software coding error or vulnerability that occurs when a function is
carried out with more data than the function can handle, resulting in adjacent memory locations being
overwritten or corrupted by the excess data1. A program contains a hidden and unintended function that
presents a security risk is not a buffer overflow, but rather a backdoor2. Malicious code designed to
interfere with normal operations is not a buffer overflow, but rather malware3. A type of covert channel that
captures data is not a buffer overflow, but rather a keylogger. References: 1
https://www.fortinet.com/resources/cyberglossary/buffer-overflow2
https://www.fortinet.com/resources/cyberglossary/backdoo3r
https://www.fortinet.com/resources/cyberglossary/malware
https://www.fortinet.com/resources/cyberglossary/keylogger
- Which of the following is the MOST important function of an information security steering committee?
A. Assigning data classifications to organizational assets
B. Developing organizational risk assessment processes
C. Obtaining multiple perspectives from the business
D. Defining security standards for logical access controls
Answer: C
Explanation:
An information security steering committee is a group of senior executives and managers from different
business units and functions who provide strategic direction, oversight, and support for the information
security program. The most important function of the committee is to obtain multiple perspectives from the
business, as this helps to ensure that the information security program aligns with the business goals,
needs, and culture, and that the security decisions reflect the interests and expectations of the
stakeholders.
References = CISM Review Manual 2022, page 331; CISM Exam Content Outline, Domain 1, Knowledge
Statement 1.22; Improve Security Governance With a Security Steering Committee2; The Role of the
Corporate Information Security Steering Committee3
- Which of the following is the GREATEST challenge with assessing emerging risk in an organization?
A. Lack of a risk framework
B. Ineffective security controls
C. Presence of known vulnerabilities
D. Incomplete identification of threats
Answer: D
Explanation: The greatest challenge with assessing emerging risk in an organization is the incomplete
identification of threats, as emerging risks are often new, unknown, or unfamiliar, and may not be fully
understood or assessed. Incomplete identification of threats can lead to gaps in risk analysis and
management, and expose the organization to unexpected or unprepared scenarios. The other options,
such as lack of a risk framework, ineffective security controls, or presence of known vulnerabilities, are not
specific to emerging risks, and may apply to any type of risk assessment. References:
✑ https://committee.iso.org/sites/tc262/home/projects/ongoing/iso-31022-guidelinesfor-
impl-2.html
✑ https://www.isac
A.org/resources/news-andtrends/
newsletters/atisaca/2023/volume-6/emerging-risk-analysis
✑ https://projectriskcoach.com/emerging-risks/
- An organization is leveraging tablets to replace desktop computers shared by shift-based staff These
tablets contain critical business data and are inherently at increased risk of theft Which of the following will
BEST help to mitigate this risk’’
A. Deploy mobile device management (MDM)
B. Implement remote wipe capability.
C. Create an acceptable use policy.
D. Conduct a mobile device risk assessment
Answer: D
Explanation: A key risk indicator (KRI) is a metric that provides an early warning of potential exposure to a
risk. A KRI should be relevant, measurable, timely, and actionable. The most important factor in an
organization’s selection of a KRI is the criticality of information, which means that the KRI should reflect the
value and sensitivity of the information assets that are exposed to the risk. For example, a KRI for data
breach risk could be the number of unauthorized access attempts to a database that contains confidential
customer dat
A. The criticality of information helps to prioritize the risks and focus on the most significant
ones. References: https://www.isac
A.org/credentialing/cism https://www.wiley.com/enus/
CISM+Certified+Information+Security+Manager+Study+Guide-p-9781119801948
- Which of the following BEST illustrates residual risk within an organization?
A. Heat map
B. Risk management framework
C. Business impact analysis (BIA)
D. Balanced scorecard
Answer: A
- Which of the following roles is BEST suited to validate user access requirements during an annual user
access review?
A. Access manager
B. IT director
C. System administrator
D. Business owner
Answer: D
Explanation:
The business owner is the best suited role to validate user access requirements during an annual user
access review, because the business owner is responsible for determining the business needs and
objectives of the users, as well as defining the appropriate access rights and privileges for each user role.
The business owner is also accountable for ensuring that the user access is aligned with the organization’s
policies and standards, and that the user access review is conducted effectively and efficiently1. The
access manager, the IT director, and the system administrator are not as suitable as the business owner,
because they are more involved in the technical and operational aspects of user access management,
rather than the business aspects.
References = Effective User Access Reviews
- Of the following, who is BEST suited to own the risk discovered in an application?
A. Information security manager
B. Senior management
C. System owner
D. Control owner
Answer: C
- Which of the following is a function of the information security steering committee?
A. Deliver external communication during incident response.
B. Align the security framework with security standards.
C. Align security strategy with business objectives.
D. Monitor regulatory requirements.
Answer: C
- An organization has been penalized by regulatory authorities for failing to notify them of a major security
breach that may have compromised customer dat
A. Which of the following is MOST likely in need of review
and updating to prevent similar penalties in the future?
A. Information security policies and procedures
B. Business continuity plan (BCP)
C. Incident communication plan
D. Incident response training program
Answer: C
- Which of the following is MOST helpful in the development of a cost-effective information security strategy
that is aligned with business requirements?
A. Enforcing data retention
B. Developing policy standards
C. Benchmarking against industry peers
D. Categorizing information assets
Answer: C
- An information security manager is MOST likely to obtain approval for a new security project when the
business case provides evidence of:
A. organizational alignment
B. IT strategy alignment
C. threats to the organization
D. existing control costs
Answer: A
Explanation:
A new security project is more likely to be approved if it aligns with the organization’s goals, objectives, and
strategies. This shows that the project supports the business needs and adds value to the organization. Or
ganizational alignment is one of the key elements of a business case for information security, as stated in
the CISM Review Manual, 16th Edition1, page 41. IT strategy alignment, threats to the organization, and
existing control costs are also important factors to consider, but they are not as persuasive as
organizational alignment in obtaining approval for a new security project. References = 1:
CISM Review Manual, 16th Edition by Isaca (Author)
Learn more: 1. isac
A.org2. amazon.com3. gov.uk
- Which of the following will BEST enable an effective information asset classification process?
A. Including security requirements in the classification process
B. Analyzing audit findings
C. Reviewing the recovery time objective (RTO) requirements of the asset
D. Assigning ownership
Answer: D
Explanation:
Assigning ownership is the best way to enable an effective information asset classification process, as it
establishes the authority and responsibility for the information asset and its protection. The owner of the
information asset should be involved in the classification process, as they have the best knowledge of the
value, sensitivity, and criticality of the asset, as well as the impact of its loss or compromise. The owner
should also ensure that the asset is properly labeled, handled, and secured according to its classification
level. (From CISM Review Manual 15th Edition)
References: CISM Review Manual 15th Edition, page 64, section 2.2.1.2; Information Asset and Security
Classification Procedure1, section 3.1.
- Which of the following is the BEST indicator of an emerging incident?
A. A weakness identified within an organization’s information systems
B. Customer complaints about lack of website availability
C. A recent security incident at an industry competitor
D. Attempted patching of systems resulting in errors
Answer: B
- Which of the following BEST provides an information security manager with sufficient assurance that a
service provider complies with the organization’s information security requirements?
A. Alive demonstration of the third-party supplier’s security capabilities
B. The ability to i third-party supplier’s IT systems and processes
C. Third-party security control self-assessment (CSA) results
D. An independent review report indicating compliance with industry standards
Answer: B
Explanation: A service provider is a third-party supplier that provides IT services or products to an
organization. A service provider should comply with the organization’s information security requirements,
such as policies, standards, procedures, and controls, to ensure the confidentiality, integrity, and availability
of the organization’s data and systems. The best way to provide an information security manager with
sufficient assurance that a service provider complies with the organization’s information security
requirements is to have the ability to audit the third-party supplier’s IT systems and processes. An audit is a
systematic and independent examination of evidence to determine the degree of conformity to
predetermined criteri
A. An audit can verify the effectiveness and efficiency of the service provider’s security
controls, identify any gaps or weaknesses, and provide recommendations for improvement. An audit can
also ensure that the service provider
adheres to the contractual obligations and service level agreements (SLAs) with the organization.
Therefore, option B is the most appropriate answer.
Option A is not the best answer because a live demonstration of the third-party supplier’s security
capabilities may not be comprehensive, objective, or reliable. A live demonstration may only show the
positive aspects of the service provider’s security, but not reveal any hidden or potential issues. A live
demonstration may also be subject to manipulation or deception by the service provider.
Option C is not the best answer because third-party security control self-assessment (CSA) results may not
be accurate, complete, or consistent. A self-assessment is a process where the service provider evaluates
its own security controls against a set of criteria or standards. A self-assessment may be biased, subjective,
or incomplete, as the service provider may not disclose or report all the relevant information or issues. A
self-assessment may also vary in quality and scope depending on the service provider’s expertise,
resources, and methodology.
Option D is not the best answer because an independent review report indicating compliance with industry
standards may not be sufficient or specific for the organization’s information security requirements. An
independent review is a process where an external party evaluates the service provider’s security controls
against a set of industry standards or best practices, such as ISO/IEC 27001, NIST CSF, PCI DSS, etc. An
independent review report may provide a general overview of the service provider’s security posture, but
not address the organization’s unique or specific security needs, risks, or expectations. An independent
review report may also be outdated, limited, or generic, as the industry standards or best practices may not
reflect the current or emerging security threats or trends. References = CISM Review Manual 15th Edition1,
pages 257-258; CISM Review Questions, Answers & Explanations Database - 12 Month Subscription, QID
301.
An independent review report indicating compliance with industry standards BEST provides an information
security manager with sufficient assurance that a service provider complies with the organization’s
information security requirements. This is because an independent review report is an objective and
reliable source of evidence that the service provider has implemented and maintained effective security
controls that meet the industry standards and best practices. An independent review report can also
provide assurance that the service provider has addressed any gaps or weaknesses identified in previous
audits or assessments.
- Which of the following incident response phases involves actions to help safeguard critical systems while
maintaining business operations?
A. Recovery
B. Identification
C. Containment
D. Preparation
Answer: C
- Which of the following is the MOST important outcome of a post-incident review?
A. The impact of the incident is reported to senior management.
B. The system affected by the incident is restored to its prior state.
C. The person responsible for the incident is identified.
D. The root cause of the incident is determined.
Answer: D
Explanation:
Determining the root cause of the incident is essential for preventing or minimizing the recurrence of similar
incidents, as well as for identifying and implementing corrective actions to improve the security posture of
the organization.
References = CISM Review Manual 2022, page 3121; CISM Exam Content Outline, Domain 4, Task 4.3
- Which of the following should be done FIRST when establishing an information security governance
framework?
A. Evaluate information security tools and skills relevant for the environment.
B. Gain an understanding of the business and cultural attributes.
C. Contract a third party to conduct an independent review of the program.
D. Conduct a cost-benefit analysis of the framework.
Answer: B
- After logging in to a web application, additional authentication is checked at various application points.
Which of the following is the PRIMARY reason for such an approach?
A. To ensure access rights meet classification requirements
B. To facilitate the analysis of application logs
C. To ensure web application availability
D. To support strong two-factor authentication protocols
Answer: A
- An organization has updated its business goals in the middle of the fiscal year to respond to changes in
market conditions. Which of the following is MOST important for the information security manager to update
in support of the new goals?
A. Information security threat profile
B. Information security policy
C. Information security objectives
D. Information security strategy
Answer: D
- Which of the following is the PRIMARY objective of information asset classification?
A. Vulnerability reduction
B. Compliance management
C. Risk management
D. Threat minimization
Answer: C
Explanation:
The primary objective of information asset classification is C. Risk management. This is because
information asset classification is a process of assigning labels or categories to information assets based
on their value, sensitivity, and criticality to the organization. Information asset classification helps the
organization to identify, assess, and treat the risks associated with the information assets, and to apply the
appropriate level of protection and controls to them. Information asset classification also helps the
organization to comply with the legal, regulatory, and contractual obligations regarding the information
assets, and to optimize the use of resources and costs for information security.
Information asset classification is a process of assigning labels or categories to information assets based
on their value, sensitivity, and criticality to the organization. Information asset classification helps the
organization to identify, assess, and treat the risks associated with the information assets, and to apply the
appropriate level of protection and controls to them. (From CISM Manual or related resources)
References = CISM Review Manual 15th Edition, Chapter 2, Section 2.2.1, page 751; CISM Review
Questions, Answers & Explanations Manual 9th Edition, Question 7, page 3; Certified Information Security
Manager Exam Prep Guide - Packt Subscription2
- Which of the following is the MOST important objective when planning an incident response program?
A. Managing resources
B. Ensuring IT resiliency
C. Recovering from a disaster
D. Minimizing business impact
Answer: D
- Which of the following would be the GREATEST obstacle to implementing incident
notification and escalation processes in an organization with high turnover?
A. Lack of knowledgeable personnel
B. Lack of communication processes
C. Lack of process documentation
D. Lack of alignment with organizational goals
Answer: A
- An employee clicked on a malicious link in an email that resulted in compromising company dat
A. What is
the BEST way to mitigate this risk in the future?
A. Conduct phishing awareness training.
B. Implement disciplinary procedures.
C. Establish an acceptable use policy.
D. Assess and update spam filtering rules.
Answer: A
Explanation:
Phishing awareness training is the best way to mitigate the risk of employees clicking on malicious links in
emails, as it educates them on how to recognize and avoid phishing attempts. (From CISM Review Manual
15th Edition)
References: CISM Review Manual 15th Edition, page 179, section 4.3.2.2.
- An organization’s information security manager is performing a post-incident review of a security incident in
which the following events occurred:
• A bad actor broke into a business-critical FTP server by brute forcing an administrative password
• The third-party service provider hosting the server sent an automated alert message to the help desk, but
was ignored
• The bad actor could not access the administrator console, but was exposed to encrypted
data transferred to the server
• After three hours, the bad actor deleted the FTP directory, causing incoming FTP attempts by legitimate
customers to fail
Which of the following could have been prevented by conducting regular incident response testing?
A. Ignored alert messages
B. The server being compromised
C. The brute force attack
D. Stolen data
Answer: A
Explanation: Ignored alert messages could have been prevented by conducting regular incident response
testing because it would have ensured that the help desk staff are familiar with and trained on how to
handle different types of alert messages from different sources, and how to escalate them appropriately.
The server being compromised could not have been prevented by conducting regular incident response
testing because it is related to security vulnerabilities or weaknesses in the server configuration or
authentication mechanisms. The brute force attack could not have been prevented by conducting regular
incident response testing because it is related to security threats or attacks from external sources. Stolen
data could not have been prevented by conducting regular incident response testing because it is related to
security breaches or incidents that may occur despite the incident response plan or process. References:
https://www.isac
A.org/resources/isaca-journal/issues/2017/volume-5/incident-response- lessons-learned
https://www.isac
A.org/resources/isaca-journal/issues/2018/volume- 3/incident-response-lessons-learned
- Which of the following would be MOST helpful when creating information security policies?
A. The information security framework
B. Business impact analysis (BIA)
C. Information security metrics
D. Risk assessment results
Answer: A
Explanation:
The information security framework is a set of principles, standards, guidelines, and best
practices that define the scope, objectives, and requirements for information security in an organization.
The information security framework is most helpful when creating information security policies because it
provides a consistent and coherent approach to managing information security risks, aligning with business
goals and strategy, and complying with relevant laws and regulations. The information security framework
also helps to establish the roles, responsibilities, and accountability of all stakeholders involved in
information security governance, management, and operations.
References = CISM Manual1, Chapter 3: Information Security Program Development (ISPD), Section 3.1:
Information Security Framework2
1: https://store.isac
A.org/s/store#/store/browse/cat/a2D4w00000Ac6NNEAZ/tiles 2: 1
- An organization wants to integrate information security into its HR management processes. Which of the
following should be the FIRST step?
A. Benchmark the processes with best practice to identify gaps.
B. Calculate the return on investment (ROI).
C. Provide security awareness training to HR.
D. Assess the business objectives of the processes.
Answer: D
Explanation: The first step when integrating information security into HR management processes is to
assess the business objectives of the processes, which means understanding the purpose, scope, and
expected outcomes of the HR functions and activities, and how they relate to the organization’s strategy
and goals. The assessment will help to identify the information security requirements, risks, and controls
that are relevant and applicable to the HR processes, and to align the information security objectives with
the business objectives.
References = CISM Review Manual 15th Edition, CISM: Overview of domains [updated 2022]
- Which of the following BEST helps to enable the desired information security culture within an
organization?
A. Information security awareness training and campaigns
B. Effective information security policies and procedures
C. Delegation of information security roles and responsibilities
D. Incentives for appropriate information security-related behavior
Answer: A
Explanation: Information security awareness training and campaigns are the best way to enable the desired
information security culture within an organization because they help to educate, motivate and influence the
behavior and attitude of the employees towards information security. They also help to raise the awareness
of the risks, threats and best practices of information security among the staff and stakeholders.
References = Organizational Culture for Information Security: A Systemic Perspective on the Articulation of
Human, Cultural and Social Systems, CISM Exam Content Outline
- What is the PRIMARY objective of implementing standard security configurations?
A. Maintain a flexible approach to mitigate potential risk to unsupported systems.
B. Minimize the operational burden of managing and monitoring unsupported systems.
C. Control vulnerabilities and reduce threats from changed configurations.
D. Compare configurations between supported and unsupported systems.
Answer: C
Explanation: The primary objective of implementing standard security configurations is to control
vulnerabilities and reduce threats from changed configurations. Standard security configurations are the
baseline settings and parameters that define the desired security level and functionality of information
systems and devices. By implementing standard security configurations, the organization can ensure that
the information systems and devices are configured in a consistent and secure manner, and that any
deviations or changes from the standard are detected and corrected. This can help to prevent or mitigate
potential security incidents caused by misconfigurations, unauthorized modifications, or malicious attacks.
References: The CISM Review Manual 2023 states that “the information security manager is responsible
for ensuring that the security configuration of information systems is in compliance with the security policies
and standards of the organization” and that “the information security manager should establish and
implement standard security configurations for information systems and devices, and monitor and review
the security configuration on a regular basis and take corrective actions when deviations or violations are
detected” (p. 138). The CISM Review Questions, Answers & Explanations Manual 2023 also provides the
following rationale for this Answer: “Control vulnerabilities and reduce threats from changed configurations
is the correct answer because it is the primary objective of implementing standard security configurations,
as it helps to maintain the security posture and functionality of information systems and devices, and to
prevent or mitigate potential security incidents caused by misconfigurations, unauthorized modifications, or
malicious attacks” (p. 63). Additionally, the article Standard Security Configurations from the ISACA Journal
2017 states that “standard security configurations are the baseline settings and parameters that define the
desired security level and functionality of information systems and devices” and that “standard security
configurations can help to control vulnerabilities and reduce threats from changed configurations by
ensuring that the information systems and devices are configured in a consistent and secure manner, and
that any deviations or changes from the standard are detected and corrected” (p. 1)
- Which of the following should an information security manager do NEXT after creating a roadmap to
execute the strategy for an information security program?
A. Obtain consensus on the strategy from the executive board.
B. Review alignment with business goals.
C. Define organizational risk tolerance.
D. Develop a project plan to implement the strategy.
Answer: D
Explanation:
The next thing that an information security manager should do after creating a roadmap to execute the
strategy for an information security program is D. Develop a project plan to
implement the strategy. This is because a project plan is a detailed document that outlines the scope,
objectives, deliverables, milestones, tasks, resources, roles, responsibilities, risks, and dependencies of the
implementation process. A project plan can help the information security manager to organize, coordinate,
monitor, and control the activities and resources required to execute the strategy and achieve the desired
outcomes. A project plan can also facilitate communication, collaboration, and reporting among the project
team, stakeholders, and sponsors.
A project plan is a detailed document that outlines the scope, objectives, deliverables, milestones, tasks,
resources, roles, responsibilities, risks, and dependencies of the implementation process. (From CISM
Manual or related resources)
References = CISM Review Manual 15th Edition, Chapter 3, Section 3.1.2, page 1281; CISM Review
Questions, Answers & Explanations Manual 9th Edition, Question 74, page 19
- The effectiveness of an incident response team will be GREATEST when:
A. the incident response team members are trained security personnel.
B. the incident response process is updated based on lessons learned.
C. incidents are identified using a security information and event monitoring {SIEM) system.
Answer: C
- Which of the following should be the PRIMARY focus of a lessons learned exercise following a successful
response to a cybersecurity incident?
A. Establishing the root cause of the incident
B. Identifying attack vectors utilized in the incident
C. When business operations were restored after the incident
D. How incident management processes were executed
Answer: D
Explanation:
The primary focus of a lessons learned exercise following a successful response to a cybersecurity incident
is to evaluate how the incident management processes were executed, and to identify the strengths,
weaknesses, best practices, and improvement opportunities for future incidents. A lessons learned
exercise is not meant to determine the root cause, the attack vectors, or the recovery time of the incident,
but rather to assess the performance and effectiveness of the incident response team and the incident
response plan.
References: The CISM Review Manual 2023 states that “post-incident reviews are an essential part of the
incident response process” and that “they provide an opportunity to assess the performance of the incident
response team, identify areas for improvement, and document lessons learned and best practices” (p. 191).
The CISM Review Questions, Answers & Explanations Manual 2023 also provides the following rationale
for this Answer: “How incident management processes were executed is the correct answer because it is
the primary focus of a lessons learned exercise, which aims to evaluate the incident response capability
and to implement corrective actions and improvement plans” (p. 97). Additionally, the Cybersecurity
Incident Response Exercise Guidance article from the ISACA Journal 2022 states that “The AAR
[after-action review] should include the date and time of the exercise, a list of participants, scenario
descriptions, findings (generic and specific), observations with recommendations, lessons learned and an
evaluation of the exercise (strengths, weaknesses, lessons learned)” (p. 3)1
- How would the information security program BEST support the adoption of emerging technologies?
A. Conducting a control assessment
B. Developing an emerging technology roadmap
C. Providing effective risk governance
D. Developing an acceptable use policy
Answer: B
Explanation: An emerging technology roadmap is a strategic plan that identifies the potential benefits, risks,
and challenges of adopting new technologies in alignment with the organization’s goals and objectives. It
also defines the roles and responsibilities, processes, and controls for managing the technology lifecycle,
from evaluation to implementation to maintenance. An emerging technology roadmap can help the
information security program support the adoption of emerging technologies by ensuring that security
requirements are considered and addressed at every stage, and that the technologies are aligned with the
organization’s risk appetite and compliance obligations.
References = CISM Review Manual, 15th Edition, page 97; Privacy, Security and Bias in Emerging
Technologies; The Impact of Emerging Technology on the Future of Cybersecurity
