CISM Chapter 1

The entity that is ultimately responsible for security governance is:

• Chief information officer

• Chief information security officer

• Board of directors

• Chief risk officer

Answer explanation

Correct answer:

"Board of directors"

The organization’s board of directors is ultimately responsible for security

governance.

An acceptable use policy is likely to contain all of the following except:

• Rules regarding the use of personally owned assets

• Permitted uses of corporate assets

• Data retention requirements

• Protection of sensitive information

Answer explanation

Correct answer:

"Data retention requirements"

An acceptable use policy (AUP) is likely to contain statements about the use

of corporate assets, personally owned assets, and information protection. Data

retention requirements are not likely to be included.

The best definition of governance is:

• Corporate policies and procedures

• Management control of business functions

• Regular reporting of metrics and key performance indicators (KPIs)

• Formal roles and responsibilities documented in a RACI chart

Answer explanation

Correct answer:

"Management control of business functions"

Governance is best defined as management’s control over business functions

throughout an organization.

Under what circumstances would an organization elect to disregard a regulation and pay fines instead of complying?

• The cost of the fines is less than the cost of compliance.

• The cost of compliance is less than the cost of fines.

• Management elected to transfer the risk.

• Management elected to avoid the risk.

Answer explanation

Correct answer:
"The cost of the fines is less than the cost of compliance."

While choosing to pay fines in lieu of compliance is uncommon, it is the best answer among the choices listed.

A database administrator (DBA) is typically responsible for all of the following except which one?

• Database performance tuning

• Database troubleshooting

• Database capacity management

• Database design

Answer explanation

Correct answer:

"Database design"

The role of database design is generally shared between the DBA and software developers/architects or is owned entirely by software developers or architects.

What is the most appropriate person or group to determine applicability of a cybersecurity-related regulation?

• Chief information security officer (CISO)

• Chief legal counsel

• Chief information risk officer (CIRO)

• Security governance committee

Answer explanation

Correct answer:
"Chief legal counsel"

Only legal counsel should be determining applicability of potentially relevant laws and regulations.

None of the other is an appropriate party to interpret regulations.

A business executive has delegated responsibility for granting access requests to the IT department. The IT department in this role is functioning as the:

• Accountable

• Owner

• Custodian

• User

Answer explanation

Correct answer is:

"Custodian"

IT is acting as a custodian in the access request process for the business application.

The business executive remains accountable for the operation. The business executive continues in the role of the system owner. IT is not the user.

What is the purpose of information security governance?

• To control all security-related activities in the organization

• To permit the organization to control all information security–related activities

• To give management visibility into and control of information security matters

• To permit the CISO to control the business and its priorities

Answer explanation

Correct answer:

"To give management visibility into and control of information security matters"

The purpose of security governance is to give management (specifically, executive management) visibility into and control of all things related to information security.

Who should be accountable for the success of an organization’s information security program?

• CISO

• Board of directors or equivalent governing body

• Security governance committee

• Shareholders

Answer explanation

Correct answer:
"Board of directors or equivalent governing body"

The board of directors or equivalent governing body must bear ultimate responsibility for the success of an organization’s information security program.

Who should approve access requests to a particular application that stores and processes customer information?

• IT

• Business owner or their delegate

• Security manager

• Security council

Answer explanation

Correct answer:
"Business owner or their delegate"

The best party to approve access requests to an application is the business owner of the application, who may be an executive or department head. Sometimes, however, this responsibility may be delegated to others.