ExamGecko
Question list
Search
Search

Question 233 - CISM discussion

Report
Export

Which of the following would BEST justify continued investment in an information security program?

A.
Reduction in residual risk
Answers
A.
Reduction in residual risk
B.
Security framework alignment
Answers
B.
Security framework alignment
C.
Speed of implementation
Answers
C.
Speed of implementation
D.
Industry peer benchmarking
Answers
D.
Industry peer benchmarking
Suggested answer: A

Explanation:

Residual risk is the risk that remains after implementing controls to mitigate the inherent risk. A reduction in residual risk indicates that the information security program is effective in managing the risks to an acceptable level. This would best justify the continued investment in the program, as it demonstrates the value and benefits of the security activities. Security framework alignment, speed of implementation, and industry peer benchmarking are not direct measures of the effectiveness or value of the information security program.They may be useful for comparison or compliance purposes, but they do not necessarily reflect the impact of the program on the risk profile of the organization.Reference= CISM Review Manual, 16th Edition, page 431; CISM Review Questions, Answers & Explanations Manual, 10th Edition, page 622 Residual risk is the remaining risk after all security controls have been implemented. It is important to measure the residual risk of an organization in order to determine the effectiveness of the security program and to justify continued investment in the program. A reduction in residual risk is an indication that the security program is effective and that continued investment is warranted.

asked 01/10/2024
Jarrell John Garcia
37 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first