Information Security Governance Flashcards

Which of the following BEST describes the primary objective of information security governance?

Answer: Aligning security strategy with business objectives

Information security governance ensures that security strategies are aligned with and support the overall business objectives of the organization.

A CISM is developing a security governance framework. Which document should serve as the TOP-LEVEL foundation?

Answer: Information security policy

The information security policy is the top-level document that establishes management's intent and provides the foundation for all other security standards and procedures.

Which governance structure BEST ensures accountability for information security across the organization?

Answer: Defined roles and responsibilities with clear ownership

Clearly defined roles and responsibilities with assigned ownership ensure accountability and enable effective governance across the organization.

An organization's board of directors is MOST responsible for which security governance activity?

Answer: Setting risk appetite and oversight

The board of directors is responsible for setting the organization's risk appetite and providing oversight of the overall security posture.

Which metric BEST demonstrates the effectiveness of an information security governance program to senior leadership?

Answer: Ratio of security incidents to business risk tolerance

Comparing security incidents against defined business risk tolerance gives leadership meaningful insight into how well the governance program is performing relative to strategic objectives.

A CISM wants to ensure that information security governance is integrated into organizational decision-making. The BEST approach is to:

Answer: Establish a security steering committee with cross-functional representation

A cross-functional security steering committee embeds security governance into broader organizational decision-making processes across business units.