ExamGecko
Question list
Search
Search

Question 274 - CISM discussion

Report
Export

Which of the following should be the FIRST step in developing an information security strategy?

A.
Determine acceptable levels of information security risk
Answers
A.
Determine acceptable levels of information security risk
B.
Create a roadmap to identify security baselines and controls
Answers
B.
Create a roadmap to identify security baselines and controls
C.
Perform a gap analysis based on the current state
Answers
C.
Perform a gap analysis based on the current state
D.
Identify key stakeholders to champion information security
Answers
D.
Identify key stakeholders to champion information security
Suggested answer: D

Explanation:

The first step in developing an information security strategy is to identify key stakeholders who can provide support, guidance and resources for information security initiatives. These stakeholders may include senior management, business unit leaders, legal counsel, audit and compliance officers and other relevant parties. By engaging these stakeholders early on, an information security manager can ensure that the strategy aligns with business objectives and expectations, as well as gain buy-in and commitment from them. Determining acceptable levels of risk, creating a roadmap and performing a gap analysis are all important steps in developing an information security strategy, but they should follow after identifying key stakeholders.

asked 01/10/2024
JUAN LUIS BERMUDEZ MAYORAL
27 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first