Information Security Program Development Flashcards

Which of the following is MOST important when establishing a security program budget?

Answer: Justifying spend based on risk reduction and business value

Security budgets should be justified through demonstrated risk reduction and business value, enabling rational resource allocation decisions.

A CISM wants to ensure the security program addresses emerging threats. The BEST approach is to:

Answer: Subscribe to threat intelligence feeds and integrate findings into risk management

Integrating threat intelligence feeds into ongoing risk management ensures the program continuously adapts to the evolving threat landscape.

When developing security policies, a CISM should ensure they are:

Answer: Approved by senior management and communicated to all staff

Security policies must be formally approved by senior management and communicated to all relevant staff to be enforceable and effective.

Which of the following BEST supports measuring the maturity of an information security program?

Answer: Using a capability maturity model to assess program components

Capability maturity models provide a structured, objective way to assess the maturity and effectiveness of security program components against defined levels.

A CISM is establishing data classification as part of the security program. The PRIMARY benefit is to:

Answer: Ensure appropriate controls are applied based on data sensitivity

Data classification ensures that protective controls are proportionate to data sensitivity, so critical data receives stronger protection than non-sensitive data.

Which of the following is a KEY responsibility of a CISM when managing the security program lifecycle?

Answer: Ensuring the program evolves in response to changing business and threat conditions

A CISM must ensure the security program continuously evolves to remain aligned with changing business objectives and an evolving threat environment.