Information Security Program Development Flashcards

A CISM is implementing a security control framework. Which of the following is MOST important when selecting a framework?

Answer: It should align with the organization's risk profile and industry requirements

Framework selection should be based on alignment with the organization's specific risk profile, regulatory environment, and industry context.

Which of the following BEST describes a 'defense-in-depth' strategy in an information security program?

Answer: Implementing multiple layers of controls so that failure of one does not expose assets

Defense-in-depth uses multiple overlapping layers of controls so that no single point of failure can compromise security.

When building a security program, which of the following activities should be performed on a CONTINUOUS basis?

Answer: Monitoring of controls effectiveness and emerging threats

Continuous monitoring of control effectiveness and the threat landscape ensures the security program remains relevant and effective as conditions change.

A CISM is developing a vulnerability management program. The FIRST step should be:

Answer: Defining the scope, assets, and criticality tiers to be covered

Defining the scope, assets covered, and their criticality ensures the vulnerability management program is structured and resources are focused appropriately.

Which of the following BEST supports a 'security by design' approach in program development?

Answer: Integrating security requirements into the project lifecycle from inception

Security by design integrates security requirements early in the system development lifecycle, reducing cost and complexity compared to retrofitting controls later.

A CISM is establishing a vendor risk management program. The MOST critical first step is to:

Answer: Identify and inventory all third-party relationships and their data access levels

Identifying and inventorying all third-party relationships and their level of access provides the foundation for assessing and managing vendor risk effectively.