CISM Domain 1-17 August

Which of the following is the MOST important consideration when developing an information security strategy?

• Regulatory requirements

• Organizational objectives

• Emerging threats

• Technological advancements

Answer explanation

The information security strategy must align with the overall organizational objectives to ensure that security initiatives support the business's goals. While regulatory requirements, emerging threats, and technological advancements are important, they should be considered within the context of the organization's specific objectives.

What is the primary purpose of establishing an information security governance framework?

• To enforce security policies

• To ensure compliance with regulations

• To align security with business objectives

• To mitigate security risks

Answer explanation

The main purpose of an information security governance framework is to ensure that information security strategies and activities align with and support the organization's business objectives. While enforcing policies, ensuring compliance, and mitigating risks are important, they are secondary to alignment with business goals.

Which of the following metrics would be the most effective in evaluating the performance of an information security program?

• Number of security incidents
  
  

• Time to resolve security incidents
  

• Alignment with business strategy

• Compliance with industry standards

Answer explanation

The effectiveness of an information security program is best measured by how well it supports and aligns with the business strategy. The other metrics are important but focus more on operational aspects rather than strategic alignment.

Which of the following should be the PRIMARY input for developing an organization's information security strategy?

• Historical security incidents

• Benchmarking data

• Business impact analysis (BIA)

• Security architecture review

Answer explanation

The PRIMARY input for developing an organization's information security strategy should be Business Impact Analysis (BIA) as it helps identify critical assets and prioritize security measures based on their impact on the business.

Which of the following BEST ensures that information security risks are effectively managed in an organization?

• Implementation of technical controls

• Periodic security audits

• An established risk management process

• Comprehensive security awareness training

Answer explanation

An established risk management process is the BEST way to ensure that information security risks are effectively managed in an organization.

The scope of the information security governance program should be determined by:

• The size of the organization

• The risk appetite of the organization

• The number of security incidents

• The complexity of the IT environment

Answer explanation

The scope of the information security governance program should be determined by the risk appetite of the organization, as it dictates the level of security measures needed to align with the organization's tolerance for risk.

A Business Impact Analysis (BIA) identifies:

• Historical security incidents

• Benchmarking data

• Critical business processes and the impact of disruptions

• Security architecture review

Answer explanation

A Business Impact Analysis (BIA) identifies critical business processes and the impact of disruptions, making it the correct choice.

What ensures that information security risks are identified, assessed, and managed consistently across the organization?

• Implementation of technical controls

• Periodic security audits

• An established risk management process

• Comprehensive security awareness training

Answer explanation

An established risk management process ensures that information security risks are identified, assessed, and managed consistently across the organization.

What defines how much risk an organization is willing to accept?

• The size of the organization

• The risk appetite of the organization

• The number of security incidents

• The complexity of the IT environment

Answer explanation

The risk appetite of the organization defines how much risk an organization is willing to accept.

Which of the following is the PRIMARY reason for integrating information security into the enterprise governance framework?

• To reduce operational costs

• To improve incident response times

• To ensure security aligns with business priorities

• To comply with regulatory requirements

Answer explanation

Integrating information security into the enterprise governance framework ensures that security is not treated as a separate function but is aligned with and supports business priorities. This alignment is more crucial than reducing costs, improving incident response, or complying with regulations alone.