(CISM) General Flashcards

An information security manager discovers that a business unit is using an unapproved cloud service to store sensitive customer data. What is the BEST first action?

Answer: Conduct a risk assessment of the cloud service

A risk assessment determines the actual exposure before taking disruptive action, enabling an informed and proportional response.

Which metric BEST demonstrates the effectiveness of an information security awareness training program?

Answer: Reduction in security incidents caused by human error

Outcome-based metrics like reduced human-error incidents directly measure whether training changed behavior, not just participation.

A CISM candidate is reviewing the organization's information security governance structure. Which element is MOST critical to effective governance?

Answer: Executive management accountability and oversight

Governance requires senior leadership accountability; without it, security strategy lacks authority and resources.

When aligning information security strategy with business objectives, the security manager should PRIMARILY focus on:

Answer: Enabling business goals while managing risk to acceptable levels

Security strategy must support business objectives by balancing risk management with operational enablement rather than simply enforcing controls.

An organization is about to launch a new product that processes health information. When should the information security manager FIRST be engaged?

Answer: During initial project planning and design

Security-by-design requires engaging the security function at project inception to embed controls rather than retrofit them.

A security manager is presenting the value of information security to the board. Which approach is MOST effective?

Answer: Present security metrics tied to business risk and financial impact

Board-level communication requires translating security activities into business risk and financial terms that resonate with executives.

Which of the following BEST describes the relationship between information security policy and procedures?

Answer: Policies define what must be done; procedures describe how to do it

Policies establish high-level requirements and intent, while procedures provide step-by-step instructions for implementing those requirements.