CISM Information Security Program Development 3

Question 1

Which of the following is MOST important when establishing a security program budget?

Accepted Answer

Justifying spend based on risk reduction and business value

Answer

Security budgets should be justified through demonstrated risk reduction and business value, enabling rational resource allocation decisions.

Question 2

A CISM wants to ensure the security program addresses emerging threats. The BEST approach is to:

Accepted Answer

Subscribe to threat intelligence feeds and integrate findings into risk management

Answer

Integrating threat intelligence feeds into ongoing risk management ensures the program continuously adapts to the evolving threat landscape.

Question 3

When developing security policies, a CISM should ensure they are:

Accepted Answer

Approved by senior management and communicated to all staff

Answer

Security policies must be formally approved by senior management and communicated to all relevant staff to be enforceable and effective.

Question 4

Which of the following BEST supports measuring the maturity of an information security program?

Accepted Answer

Using a capability maturity model to assess program components

Answer

Capability maturity models provide a structured, objective way to assess the maturity and effectiveness of security program components against defined levels.

Question 5

A CISM is establishing data classification as part of the security program. The PRIMARY benefit is to:

Accepted Answer

Ensure appropriate controls are applied based on data sensitivity

Answer

Data classification ensures that protective controls are proportionate to data sensitivity, so critical data receives stronger protection than non-sensitive data.

CISM - Certified Information Security Manager Practice Test

CISM - Certified Information Security Manager Practice Test

CISM Information Security Program Development 3