ExamGecko
Question list
Search
Search

Question 255 - CISM discussion

Report
Export

Which of the following should be the PRIMARY objective of an information security governance framework?

A.
Provide a baseline for optimizing the security profile of the organization.
Answers
A.
Provide a baseline for optimizing the security profile of the organization.
B.
Demonstrate senior management commitment.
Answers
B.
Demonstrate senior management commitment.
C.
Demonstrate compliance with industry best practices to external stakeholders.
Answers
C.
Demonstrate compliance with industry best practices to external stakeholders.
D.
Ensure that users comply with the organization's information security policies.
Answers
D.
Ensure that users comply with the organization's information security policies.
Suggested answer: A

Explanation:

According to the Certified Information Security Manager (CISM) Study Manual, 'The primary objective of information security governance is to provide a framework for managing and controlling information security practices and technologies at an enterprise level. Its goal is to manage and reduce risk through a process of identification, assessment, and management of those risks.'

While demonstrating senior management commitment, compliance with industry best practices, and ensuring user compliance with policies are all important aspects of information security governance, they are not the primary objective. The primary objective is to manage and reduce risk by establishing a framework for managing and controlling information security practices and technologies at an enterprise level.

Certified Information Security Manager (CISM) Study Manual, 15th Edition, Page 60.

asked 01/10/2024
Samuel Ernesto
32 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first