Download CISM - INFORMATION SECURITY GOVERNANCE, STRATEGY, OBJECTIVES & METRICS Q AND A and more Exams Information Security and Markup Languages in PDF only on Docsity!
CISM - INFORMATION SECURITY GOVERNANCE,
STRATEGY, OBJECTIVES & METRICS QUESTIONS AND
ANSWERS 100% CORRECT
- B is the correct answer. Justification The task of identifying business risk that affects the organization is assigned and acted on after establishing the need for creating the program. In developing an information security management program, the first step is to establish the need for creating the program. This is a business decision based more on judgment than on any specific quantitative measures. The other choices are assigned and acted on after establishing the need. The task of assigning responsibility for the program is assigned and acted on after establishing the need for creating the program. The task of assessing the adequacy of existing controls is assigned and acted on after establishing the need for creating
the program.: The FIRST step in developing an information security management program is to: identify business risk that affects the organization. establish the need for creating the program. assign responsibility for the program. assess adequacy of existing controls.
- B is the correct answer. Justification Centralized information security management is generally less expensive to administer due to the economies of scale. Centralization of information security management results in greater unifor- mity and better adherence to security policies. With centralized information security management, information security is typically less responsive to specific business unit needs. With centralized information security management, turnaround can be slow- er due to greater separation and more bureaucracy between the information security department and end users.: Which of the following is characteristic
More expensive to administer Better adherence to policies More aligned with business unit needs Faster turnaround of requests
- C is the correct answer. Justification Uniformity in quality of service tends to vary from unit to unit. Adherence to policies is likely to vary considerably between various busi- ness units. Decentralization of information security management generally results in better alignment to business unit needs because security management is closer to the end user. Decentralization of information security management is generally more ex- pensive to administer due to the lack of economies of scale.: Which of the following is characteristic of decentralized information security management across a geographically dispersed organization?
More uniformity in quality of service Better adherence to policies Better alignment to business unit needs More savings in total operating costs
- C is the correct answer. Justification The number of employees has little or no effect on standard information security governance models. The distance between physical locations has little or no effect on standard information security governance models. Information security governance models are highly dependent on the overall organizational structure. Some of the elements that impact organizational structure are multiple missions and functions across the organization, lead-
Approving access to critical financial systems is the responsibility of indi- vidual system data owners. Domain: Which of the following activities MOST commonly falls within the scope of an information security governance steering committee? Interviewing candidates for information security specialist positions Developing content for security awareness programs Prioritizing information security initiatives Approving access to critical financial systems
- C is the correct answer. Justification
Adopting suitable security standards that implement the intent of the poli- cies follows the development of policies that support the strategy. Security baselines are established as a result of determining acceptable risk, which should be defined as a requirement prior to strategy development. Security governance must be developed to meet and support the objectives of the information security strategy. Policies are a primary instrument of governance and must be developed or modified to support the strategy.: While implementing information security governance an organization should FIRST: adopt security standards. determine security baselines. define the security strategy. establish security policies.
- A is the correct answer.
be aligned with the corporate business strategy. be based on a sound risk management approach. provide adequate regulatory compliance. provide good practices for security initiatives.
- A is the correct answer. Justification The existence of a steering committee that approves all security projects would be an indication of the existence of a good governance program. To en- sure that all stakeholders impacted by security considerations are involved, many organizations use a steering committee comprised of senior represen- tatives of affected groups. This composition helps to achieve consensus on priorities and trade-offs and serves as an effective communication channel for ensuring the alignment of the security program with business objectives. Security policy training is important at all levels of the organization and also an indicator of good governance. However, it must be guided and approved as a security project by the steering committee to ensure all parts of the organization are aware of the policies.
The availability of security training, while beneficial to the overall security program, does not ensure that employees are following the program and have the required level of awareness without a process to enforce awareness and compliance. Even organizations with little overall governance may be effective in patch- ing systems in a timely manner; this is not an indication of effective gover- nance.: Which of the following would be the BEST indicator of effective information security governance within an organization? The steering committee approves security projects. Security policy training is provided to all managers.
organizational risk. organizationwide metrics. security needs. the responsibilities of organizational units.
- B is the correct answer. Justification Security awareness training will promote the security policies, procedures and appropriate use of the security mechanisms but will not precede infor- mation security governance implementation. Updated security policies are required to align management business ob- jectives with security processes and procedures. Management objectives translate into policy; policy translates into standards and procedures. An incident management team will not be the first requirement for the imple-
mentation of information security governance and can exist even if formal governance is minimal. Information security governance provides the basis for architecture and must be implemented before a security architecture is developed.: Successful implementation of information security governance will FIRST require: security awareness training. updated security policies. a computer incident management team. a security architecture.
- D is the correct answer. Justification Organizational standards must be subordinate to local regulations. It would be incorrect to follow local regulations only because there must be recognition of organizational requirements. Making an organization aware of standards is a sensible step
Justification A positive security environment (culture) enables successful implementa- tion of the security strategy but is not as important as alignment with business objectives during the development of the strategy. Alignment with business strategy is essential in determining the security needs of the organization; this can only be achieved if key business objec- tives driving the strategy are understood. A reporting line to senior management may be helpful in developing a strat- egy but does not ensure an understanding of business objectives necessary for strategic alignment. Allocation of resources is not likely to be effective if the business objectives are not well understood.: Which of the following is MOST important in developing a security strategy? Creating a positive business security environment Understanding key business objectives Having a reporting line to senior management
Allocating sufficient resources to information security
- B is the correct answer. Justification Technical vulnerabilities as a component of risk will be most relevant in the context of threats to achieving the business objectives defined in the business strategy. An information security manager needs to gain an understanding of the current business strategy and direction to understand the organization's ob- jectives and the impact of the other answers on achieving those objectives. A business impact analysis should be performed prior to developing a
An acceptable level of risk in an organization is a business decision, not a security decision. External auditors can point out areas of risk but are not in a position to determine what levels of risk the organization is willing to assume. Senior management, represented in the steering committee, has ultimate responsibility for determining what levels of risk the organization is willing to assume.: Acceptable levels of information security risk should be determined by: legal counsel. security management. external auditors. the steering committee.
- B is the correct answer.
Justification Directing regulators to a specific person or department is not as effective as performing self-assessments. Self-assessments provide the best feedback on readiness and permit iden- tification of items requiring remediation. Assessing previous regulatory reports is not as effective as performing self-assessments since conditions may have changed. The legal department should review all formal inquiries, but this does not help prepare for a regulatory review.: Which of the following would BEST pre- pare an information security manager for regulatory reviews? Assign an information security administrator as regulatory liaison. Perform self-assessments using regulatory guidelines and reports. Assess previous regulatory reports with process owners input. Ensure all regulatory inquiries are sanctioned by the legal department.
- B is the correct answer. Justification
