ExamGecko
Question list
Search
Search

Question 97 - CISM discussion

Report
Export

Which of the following is the FIRST step to establishing an effective information security program?

A.
Conduct a compliance review.
Answers
A.
Conduct a compliance review.
B.
Assign accountability.
Answers
B.
Assign accountability.
C.
Perform a business impact analysis (BIA).
Answers
C.
Perform a business impact analysis (BIA).
D.
Create a business case.
Answers
D.
Create a business case.
Suggested answer: D

Explanation:

According to the CISM Review Manual, the first step to establishing an effective information security program is to create a business case that aligns the program objectives with the organization's goals and strategies. A business case provides the rationale and justification for the information security program and helps to secure the necessary resources and support from senior management and other stakeholders. A business case should include the following elements:

The scope and objectives of the information security program

The current state of information security in the organization and the gap analysis

The benefits and value proposition of the information security program

The risks and challenges of the information security program

The estimated costs and resources of the information security program

The expected outcomes and performance indicators of the information security program

The implementation plan and timeline of the information security program

Reference= CISM Review Manual, 16th Edition, Chapter 3, Section 2, pages 97-99.

asked 01/10/2024
Peter Jennings
34 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first