ExamGecko
Question list
Search
Search

Question 355 - CISM discussion

Report
Export

In the context of developing an information security strategy, which of the following provides the MOST useful input to determine the or:

A.
Security budget
Answers
A.
Security budget
B.
Risk register
Answers
B.
Risk register
C.
Risk score
Answers
C.
Risk score
D.
Laws and regulations
Answers
D.
Laws and regulations
Suggested answer: D

Explanation:

Laws and regulations provide the most useful input to determine the organization's information security strategy because they define the legal and compliance requirements and obligations that the organization must adhere to, and guide the development and implementation of the security policies and controls that support them. Security budget is not a useful input to determine the organization's information security strategy because it does not reflect the organization's security needs or goals, but rather a resource to enable the security activities and initiatives. Risk register is not a useful input to determine the organization's information security strategy because it does not reflect the organization's security vision or mission, but rather a tool to identify and manage the security risks. Risk score is not a useful input to determine the organization's information security strategy because it does not reflect the organization's security priorities or objectives, but rather a measure of the level of risk exposure or performance.

Reference: https://www.isaca.org/resources/isaca-journal/issues/2016/volume-4/technical-security-standards-for-information-systems https://www.isaca.org/resources/isaca-journal/issues/2017/volume-2/how-to-align-security-initiatives-with-business-goals-and-objectives

asked 01/10/2024
ali ghoubali
35 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first