Information Security Program Development Flashcards

When developing an information security program, a CISM should FIRST:

Answer: Define the security program's scope and objectives based on business needs

Defining the scope and objectives aligned to business needs ensures the security program is purposeful, relevant, and capable of gaining organizational support.

Which of the following is MOST critical to the long-term success of an information security program?

Answer: Ongoing executive sponsorship and adequate resourcing

Sustained executive sponsorship and adequate resources are the most critical success factors for a security program's long-term effectiveness.

A CISM is selecting security controls for a new information security program. Controls should PRIMARILY be selected based on:

Answer: Risk assessment results and business requirements

Control selection should be driven by risk assessment results and business requirements to ensure controls address actual risks and support business operations.

Which of the following BEST describes the purpose of a security awareness training program?

Answer: To educate employees about threats and their role in protecting information

Security awareness training educates employees about information security threats and their individual responsibilities in protecting organizational assets.

A CISM is developing a security roadmap. The roadmap should be aligned to:

Answer: The organization's strategic business plan and risk tolerance

A security roadmap must align to the organization's strategic business plan and risk tolerance to ensure security investments support business goals.

Which metric is MOST useful for measuring the effectiveness of a security awareness program?

Answer: Reduction in security incidents attributable to human error over time

Measuring the reduction in human-error-related incidents over time provides evidence of behavior change, the true goal of awareness training.