CSL CSL Security Budgeting & Program Management 2 — Questions and Answers
Question 1: Which project management methodology is most commonly adapted for managing cybersecurity programs with evolving requirements?
- Waterfall methodology with fixed sequential phases
- Agile/iterative methodology with sprint-based planning (Correct answer)
- PRINCE2 with rigid stage gates
- Critical path method (CPM) scheduling
Correct answer: Agile/iterative methodology with sprint-based planning
Agile methodology accommodates the dynamic and evolving nature of cybersecurity threats and organizational priorities better than rigid sequential approaches.
Question 2: What is the purpose of a security program roadmap in a CISO's strategic plan?
- To document past security incidents and lessons learned
- To visualize the multi-year journey from current security posture to target state (Correct answer)
- To replace the need for an annual security budget
- To assign all security tasks to individual employees
Correct answer: To visualize the multi-year journey from current security posture to target state
A security roadmap communicates the phased plan for advancing security capabilities over time, helping align stakeholders on priorities and resource needs.
Question 3: Which KPI best indicates that a vulnerability management program is operating effectively?
- Total number of vulnerabilities discovered
- Mean time to remediate (MTTR) critical vulnerabilities within SLA targets (Correct answer)
- Number of penetration tests conducted per year
- Total patching budget expended
Correct answer: Mean time to remediate (MTTR) critical vulnerabilities within SLA targets
MTTR for critical vulnerabilities measures actual risk reduction speed, directly demonstrating whether the vulnerability management program is closing exposure windows on time.
Question 4: A cybersecurity leader is managing a large-scale security tool consolidation project. What is the greatest risk to project success?
- Vendor pricing increases during the project
- Loss of security coverage during the transition period between old and new tools (Correct answer)
- Staff resistance to learning new systems
- Exceeding the project timeline by one month
Correct answer: Loss of security coverage during the transition period between old and new tools
Tool consolidation projects risk creating security coverage gaps if old tools are decommissioned before new tools are fully operational and validated.
Question 5: What is the primary benefit of aligning the cybersecurity program to a recognized framework such as NIST CSF?
- Automatic regulatory compliance across all US regulations
- A common language and structure for communicating security posture to stakeholders (Correct answer)
- Elimination of the need for internal risk assessments
- Guaranteed cyber insurance premium reductions
Correct answer: A common language and structure for communicating security posture to stakeholders
NIST CSF provides a common vocabulary and structure that enables consistent communication about security capabilities, gaps, and investments with business and technical stakeholders.
Question 6: How should a CISO measure and communicate the ROI of cybersecurity investments to the board?
- Through the number of technical controls deployed
- By quantifying risk reduction in financial terms relative to investment cost (Correct answer)
- By comparing spending to industry average benchmarks
- Through employee satisfaction surveys after security training
Correct answer: By quantifying risk reduction in financial terms relative to investment cost
Demonstrating how investments reduce quantified financial risk exposure (e.g., reducing expected annual loss by $X for $Y investment) makes ROI tangible to financial decision-makers.
CSL CSL Security Budgeting & Program Management 2
Which project management methodology is most commonly adapted for managing cybersecurity programs with evolving requirements?