CISM Exam Questions and Answers | Exam-Dumps (Page: 28)

QUESTION: 136

The MAIN reason for having the Information Security Steering Committee review a new security controls implementation plan is to ensure that:

the plan aligns with the organization's business plan.
departmental budgets are allocated appropriately to pay for the plan.
regulatory oversight requirements are met.
the impact of the plan on the business units is reduced.

Answer(s): A

Explanation:

The steering committee controls the execution of the information security strategy according to the needs of the organization and decides on the project prioritization and the execution plan. The steering committee does not allocate department budgets for business units. While ensuring that regulatory oversight requirements are met could be a consideration, it is not the main reason for the review. Reducing the impact on the business units is a secondary concern but not the main reason for the review.

Reveal Solution Next Question

QUESTION: 137

Which of the following should be determined while defining risk management strategies?

Risk assessment criteria
Organizational objectives and risk appetite
IT architecture complexity
Enterprise disaster recovery plans

Answer(s): B

Explanation:

While defining risk management strategies, one needs to analyze the organization's objectives and risk appetite and define a risk management framework based on this analysis. Some organizations may accept known risks, while others may invest in and apply mitigation controls to reduce risks. Risk assessment criteria would become part of this framework, but only after proper analysis. IT architecture complexity and enterprise disaster recovery plans are more directly related to assessing risks than defining strategies.

Reveal Solution Next Question

QUESTION: 138

When implementing effective security governance within the requirements of the company's security strategy, which of the following is the MOST important factor to consider?

Preserving the confidentiality of sensitive data
Establishing international security standards for data sharing
Adhering to corporate privacy standards
Establishing system manager responsibility for information security

Answer(s): A

Explanation:

The goal of information security is to protect the organization's information assets. International security standards are situational, depending upon the company and its business. Adhering to corporate privacy standards is important, but those standards must be appropriate and adequate and are not the most important factor to consider. All employees are responsible for information security, but it is not the most important factor to consider.

Reveal Solution Next Question

QUESTION: 139

Which of the following is the BEST reason to perform a business impact analysis (BIA)?

To help determine the current state of risk
To budget appropriately for needed controls
To satisfy regulatory requirements
To analyze the effect on the business

Answer(s): A

Explanation:

The BIA is included as part of the process to determine the current state of risk and helps determine the acceptable levels of response from impacts and the current level of response, leading to a gap analysis. Budgeting appropriately may come as a result, but is not the reason to perform the analysis. Performing an analysis may satisfy regulatory requirements, bill is not the reason to perform one. Analyzing the effect on the business is part of the process, but one must also determine the needs or acceptable effect or response.

Reveal Solution Next Question

QUESTION: 140

Which of the following BEST enables the deployment of consistent security throughout international branches within a multinational organization?

Maturity of security processes
Remediation of audit findings
Decentralization of security governance
Establishment of security governance

Answer(s): D

Reveal Solution Next Question

ISACA CISM Exam (page: 28) ISACA Certified Information Security Manager Updated on: 25-Dec-2025

QUESTION: 136

Explanation:

QUESTION: 137

Explanation:

QUESTION: 138

Explanation:

QUESTION: 139

Explanation:

QUESTION: 140

ISACA CISM Exam (page: 28)
ISACA Certified Information Security Manager
Updated on: 25-Dec-2025