CISM Exam Dumps - Isaca Certification Questions and Answers

Escalate to senior management, because this could help the information security manager to inform the decision-makers of the situation, explain the implications and trade-offs, and seek their guidance and approval for the next steps2. However, this answer is not certain, and you might need to consider other factors as well.

Security policy provisions are the statements or rules that define the information security objectives, principles, roles and responsibilities, and requirements for the organization. Security policy provisions must be established to maintain an effective information security governance framework, as they provide the foundation and direction for the information security activities and processes within the organization. Security policy provisions also help to align the information security governance framework with the business strategy and objectives, and ensure compliance with relevant laws and regulations. The other options, such as security controls automation, defined security metrics, or change management processes, are important components of an information security governance framework, but they are not essential to establish it. References:

https://www.iso.org/standard/74046.html

https://www.nistf.gov/cyberframework

https://www.iso.org/standard/27001

Identify and assess the risk in the context of business objectives. Before making any changes to the security policy or introducing any new controls, the information security manager should first identify and assess the risk that the new privacy regulation poses to the business. This should be done in the context of the overall business objectives so that the security measures introduced are tailored to meet the specific needs of the organization.

The best mitigation for information loss caused by a cloud service provider becoming insolvent is contractual provisions for data repatriation . In CISM third-party and cloud governance, organizations must ensure they can retrieve their data in a usable format if a provider fails, terminates service, or becomes financially insolvent. Data repatriation clauses define how data will be returned, in what format, within what timeframe, and how securely it will be transferred or deleted from the provider environment. Right-to-audit clauses help assess controls but do not ensure data recovery if the provider fails. Data loss prevention controls reduce unauthorized data leakage, but they do not address provider insolvency or service termination. Cybersecurity insurance may offset some financial loss, but it does not restore access to critical information. Because data availability and portability are central cloud exit strategy requirements, contractual repatriation rights are the strongest control to mitigate the risk of losing access to information due to provider insolvency.

Risk assessment is the BEST input to a business case for a technical solution to address potential system vulnerabilities, because it helps to identify and prioritize the most critical risks that the solution should mitigate or reduce. Risk assessment also helps to evaluate the costs and benefits of the solution in terms of reducing the likelihood and impact of potential threats and incidents.

References =

CISM Review Manual, 16th Edition, ISACA, 2020, p. 47: “Risk assessment is the process of identifying and analyzing information security risks and determining their potential impact on the enterprise’s business objectives.”

CISM Review Manual, 16th Edition, ISACA, 2020, p. 48: “Risk assessment provides input to the business case for information security investments by identifying and prioritizing the most critical risks that need to be addressed and evaluating the costs and benefits of the proposed solutions.”

 Strengthening endpoint security is the most immediate focus when shifting to a work-from-home model with an increased need for remote access security, as this reduces the risk of unauthorized access, data leakage, malware infection, and other threats that may compromise the confidentiality, integrity, and availability of the organization’s information assets. Moving to a zero trust access model, enabling network-level authentication, and enhancing cyber response capability are also important, but not as urgent as strengthening endpoint security, as they require more time, resources, and planning to implement effectively. References = CISM Review Manual 2023, page 1561; CISM Review Questions, Answers & Explanations Manual 2023, page 302; ISACA CISM - iSecPrep, page 153

The correct answer is C because standards define mandatory minimum requirements and baselines that must be followed to comply with policy. In information security governance, policies state management intent and high-level requirements, while standards translate those requirements into specific mandatory control baselines. For example, a password policy may state that access must be protected, while a password standard defines minimum length, complexity, history, and expiration requirements. Procedures provide step-by-step instructions for performing tasks, and guidelines provide recommended but usually nonmandatory advice. The question asks specifically for the minimum technical baseline, which is the function of standards. Standards ensure consistency across systems, technologies, and business units by defining the minimum acceptable level of security. This supports governance, compliance, and control implementation. In CISM practice, policies, standards, procedures, and guidelines form a hierarchy, with standards serving as enforceable requirements derived from policy.

Risk treatment should be prioritized based on risk criticality. Addressing the most severe and likely risks first ensures that resources are focused where they can have the greatest impact.

“Risk treatment efforts should focus on the most significant risks first, based on likelihood and impact.”

— CISM Review Manual 15th Edition, Chapter 2: Risk Management, Section: Risk Treatment Options*

 A preventive control is a type of control that aims to prevent or reduce the occurrence or impact of potential adverse events that can affect the organization’s objectives and performance. Preventive controls are proactive measures that are implemented before an incident happens, and they are designed to address the root causes or sources of risk. Preventive controls can also help the organization to comply with the relevant laws, regulations, standards, and best practices regarding information security1.

An example of a preventive control is a redundant power supply, which is a backup or alternative source of power that can be used in case of a power outage or failure. A redundant power supply can reduce the business risk associated with critical system outages, which can result from power disruptions caused by natural disasters, technical faults, human errors, or malicious attacks. A redundant power supply can provide the following benefits for information security2:

Maintain the availability and continuity of the critical systems and services that depend on power, such as servers, databases, networks, or applications. A redundant power supply can ensure that the critical systems and services can operate normally or resume quickly after a power outage or failure, minimizing the downtime and data loss that can affect the organization’s operations, customers, or reputation.

Protect the integrity and reliability of the critical systems and data that are stored or processed by the power-dependent devices, such as computers, hard drives, or memory cards. A redundant power supply can prevent or reduce the damage or corruption of the critical systems and data that can be caused by sudden or unexpected power fluctuations, surges, or interruptions, which can compromise the accuracy, completeness, or consistency of the information.

Enhance the resilience and redundancy of the power infrastructure and network that supports the critical systems and services. A redundant power supply can provide an alternative or backup route for power delivery and distribution, which can increase the flexibility and adaptability of the power infrastructure and network to cope with different scenarios or conditions of power supply or demand.

The other options are not the type of control that is being considered by the organization. A corrective control is a type of control that aims to restore or recover the normal state or function of the affected systems or processes after an incident has occurred. A corrective control is a reactive measure that is implemented during or after an incident, and it is designed to address the consequences or impacts of risk. A corrective control can also help the organization to learn from the incident and improve its information security practices1. An example of a corrective control is a backup or restore system, which is a method of creating and restoring copies of the system or data that have been lost or damaged due to an incident.

A detective control is a type of control that aims to identify or discover the occurrence or existence of an incident or a deviation from the expected or desired state or behavior of the systems or processes. A detective control is a monitoring or auditing measure that is implemented during or after an incident, and it is designed to provide information or evidence of risk. A detective control can also help the organization to analyze or investigate the incident and determine the root cause or source of risk1. An example of a detective control is a log or alert system, which is a tool of recording or reporting the activities or events that have occurred or are occurring within the systems or processes.

A deterrent control is a type of control that aims to discourage or dissuade the potential perpetrators or sources of risk from initiating or continuing an incident or an attack. A deterrent control is a psychological or behavioral measure that is implemented before or during an incident, and it is designed to influence or manipulate the motivation or intention of risk. A deterrent control can also help the organization to reduce the likelihood or frequency of incidents or attacks1. An example of a deterrent control is a warning or notification system, which is a method of communicating or displaying the consequences or penalties of violating the information security policies or rules. References = Risk Control Techniques: Preventive, Corrective, Directive, And …, Learn Different types of Security Controls in CISSP - Eduonix Blog

The best option to facilitate recovery of data lost as a result of a cybersecurity incident is offsite data backups. This is because offsite data backups provide a secure and reliable way to restore data that may have been corrupted, deleted, or encrypted by malicious actors. Offsite data backups also reduce the risk of data loss due to physical damage, theft, or natural disasters that may affect the primary data storage location. Offsite data backups should be part of a comprehensive disaster recovery plan (DRP) that defines the roles, responsibilities, procedures, and resources for restoring normal operations after a cyber incident.

Purchasing cybersecurity insurance is a textbook example of risk transfer — transferring financial risk to a third party (the insurer).

“Risk transfer shifts the impact of a risk to another party, such as through insurance or outsourcing.”

— CISM Review Manual 15th Edition, Chapter 2: Risk Management, Section: Risk Treatment*

= According to the CISM Review Manual, one of the key success factors for an information security program is to maintain management support and commitment. This can be achieved by providing regular reports to management on the security status of the organization, the effectiveness of the security controls, and the alignment of the security program with the business objectives and strategy. By informing management about the security of business operations, the information security manager can demonstrate the value and benefits of the security program, and ensure that management is aware of the security risks and issues that need to be addressed. This technique can also help to build trust and confidence between the information security manager and the senior management, and foster a culture of security within the organization1

The other options are not as effective as informing management about the security of business operations. Implementing a comprehensive security awareness and training program is important, but it is mainly targeted at the end users and staff, not the senior management. Identifying the risks and consequences of failure to comply with standards can help to justify the need for security controls, but it can also create a negative impression of the security program as being too restrictive or punitive. Benchmarking the security programs of comparable organizations can provide some insights and best practices, but it may not reflect the specific needs and context of the organization, and it may not be relevant or applicable to the management’s expectations and priorities1

References = 1: CISM Review Manual, 16th Edition, ISACA, 2020, pp. 28-29…

Residual risk exposure (A) is the most important factor to emphasize because senior management is responsible for accepting or rejecting risk on behalf of the organization. CISM guidance stresses that executives are less concerned with technical details and more focused on what risk remains after controls are applied and whether it exceeds risk appetite. Threat details (B), architectural gaps (C), and industry breaches (D) can provide context, but they do not directly answer the key governance question: What level of risk does the organization still face? Presenting residual risk enables informed decision-making about whether additional controls are justified.

A well-defined organizational hierarchy best enables the design of an effective incident escalation process. Incident escalation requires clarity about authority, reporting paths, decision-making responsibility, and communication channels. CISM incident management emphasizes that response processes must define roles, responsibilities, thresholds, and escalation procedures before incidents occur. Without a clear organizational hierarchy, incidents may be delayed, misrouted, or escalated to personnel without appropriate authority. Enforceable control baselines and defense-in-depth controls are important for prevention and security consistency, but they do not define escalation paths. A comprehensive risk register supports risk management but does not by itself establish who must be notified or who can make response decisions during an incident. Escalation must align with the organization’s management structure so that operational, legal, communications, and executive decisions can be made quickly. Therefore, a well-defined organizational hierarchy is the strongest foundation for an effective escalation process.

Information security strategy is the most important factor when defining how an information security budget should be allocated because it helps to align the security objectives and initiatives with the business goals and priorities. An information security strategy is a high-level plan that defines the vision, mission, scope, and direction of the security program, as well as the roles and responsibilities, governance structures, policies and standards, risk management approaches, and performance measurement methods. An information security strategy helps to identify and prioritize the security needs and requirements of the organization, as well as to allocate the resources and funding accordingly. An information security strategy also helps to communicate the value and benefits of security to the stakeholders and justify the security investments. Therefore, information security strategy is the correct answer.

The correct answer is D because the primary objective of an information classification scheme is to ensure that information receives protection appropriate to its sensitivity, criticality, value, and risk. Classification labels such as public, internal, confidential, and restricted help determine required controls for access, storage, transmission, encryption, retention, monitoring, and disposal. Legislative and regulatory requirements may influence classification rules, but compliance is not the only objective. Developing an asset inventory is important because organizations need to know what information assets they have, but classification goes further by assigning protection levels. Defining data retention requirements may be supported by classification, but retention is only one control area. In CISM risk management, controls should be risk-based and cost-effective. Overprotecting low-risk data wastes resources, while underprotecting sensitive data increases exposure. A classification scheme enables consistent, proportionate, and risk-aligned protection of information assets. Therefore, the primary objective is to implement controls proportionate to risk.

Integrating vulnerability testing (D) into the SDLC is the most effective way to identify backdoors and security weaknesses before deployment. CISM emphasizes secure development practices, including testing and validation, as essential controls. UAT (A) focuses on functionality, separation of duties (B) addresses governance, and training (C) is supportive but insufficient on its own. Vulnerability testing provides direct detection of exploitable flaws.

The Recovery Time Objective (RTO) specifies the maximum acceptable downtime before operations must resume. A 30-minute requirement directly defines the RTO for those systems.

“RTO defines the duration within which systems must be restored following an outage to prevent unacceptable business impact.”

— CISM Review Manual 15th Edition, Chapter 3: Business Continuity Planning, Section: Continuity Metrics*