ExamGecko
Question list
Search
Search

Question 559 - CISM discussion

Report
Export

Which of the following is MOST important to consider when defining control objectives?

A.
Industry best practices
Answers
A.
Industry best practices
B.
An information security framework
Answers
B.
An information security framework
C.
Control recommendations from a recent audit
Answers
C.
Control recommendations from a recent audit
D.
The organization's risk appetite
Answers
D.
The organization's risk appetite
Suggested answer: D

Explanation:

The organization's risk appetite is the most important factor to consider when defining control objectives, because it reflects the amount and type of risk that the organization is willing to accept or avoid in pursuit of its goals. Control objectives should align with the risk appetite and support the achievement of the organization's objectives. Industry best practices, an information security framework, and control recommendations from a recent audit are also useful sources of guidance, but they are not as critical as the risk appetite.

Reference= CISM Review Manual, 16th Edition, page 75

asked 01/10/2024
Bernardo Garcia
43 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first