ExamGecko
Question list
Search
Search

Question 351 - CISM discussion

Report
Export

Which of the following should be done FIRST when implementing a security program?

A.
Perform a risk analysis
Answers
A.
Perform a risk analysis
B.
Implement data encryption.
Answers
B.
Implement data encryption.
C.
Create an information asset inventory.
Answers
C.
Create an information asset inventory.
D.
Determine the value of information assets.
Answers
D.
Determine the value of information assets.
Suggested answer: A

Explanation:

Performing a risk analysis is the first step when implementing a security program because it helps to identify and prioritize the potential threats and vulnerabilities that may affect the organization's assets, processes, or objectives, and determine their impact and likelihood. Implementing data encryption is not the first step, but rather a possible subsequent step that involves applying a specific security control or technique to protect data from unauthorized access or modification. Creating an information asset inventory is not the first step, but rather a possible subsequent step that involves identifying and classifying the organization's assets based on their value and sensitivity. Determining the value of information assets is not the first step, but rather a possible subsequent step that involves estimating and quantifying the worth of information assets to the organization.

Reference: https://www.isaca.org/resources/isaca-journal/issues/2015/volume-6/measuring-the-value-of-information-security-investments https://www.isaca.org/resources/isaca-journal/issues/2017/volume-3/how-to-measure-the-effectiveness-of-your-information-security-management-system

asked 01/10/2024
Paul Pinero
31 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first