CISM Exam Dumps and Practice Questions

The most effective way to communicate the value of information security to senior management is to describe how security enables business objectives (B). CISM emphasizes that executives view security as valuable when it supports revenue generation, operational resilience, customer trust, and strategic goals. Discussing training benefits (A), potential impacts (C), or ROI (D) alone frames security as a cost or fear-based function. Positioning security as a business enabler aligns it with executive priorities and promotes sustained support.

Reviewing the new standard for applicability to the business is the first course of action, as it helps to understand the changes, gaps, and impacts of the revision on the organization's security posture, compliance status, and business objectives. Evaluating the cost of maintaining the certification, modifying policies to ensure new requirements are covered, and communicating the new standard to senior leadership are important steps, but they should be done after reviewing the new standard for applicability to the business.

References= CISM Review Manual 2022, page 361; CISM Exam Content Outline, Domain 1, Task 1.2

The correct answer is B because the system owner is best positioned to decide on the implementation of mitigating controls for a business information system. The system owner is accountable for the system's business purpose, data, operational impact, and associated risk. After a risk assessment identifies threats, vulnerabilities, likelihood, impact, and recommended controls, the system owner must decide which risk treatment actions are appropriate based on business needs, risk appetite, cost, and operational requirements. A system administrator may implement technical controls, but does not normally own the business risk. The chief information officer may provide technology oversight, but may not be the accountable owner of the specific business system. The risk manager facilitates the risk management process and provides guidance, but risk treatment decisions belong to the risk or system owner. In CISM, business ownership and accountability are central principles. Information security managers advise and recommend, but accountable business or system owners decide on mitigation.

The next step for the information security manager should be to inventory and review the current security policies to understand the existing security requirements, controls, and gaps. This will help to identify the areas that need to be updated, revised, or replaced to align with the current business needs and objectives, as well as the legal and regulatory requirements. Updating the policies in accordance with the best business practices, performing a risk assessment of the current IT environment, or gaining an understanding of the current business direction are important activities, but they should be done after reviewing the current security policies.

References= CISM Review Manual, 16th Edition eBook1, Chapter 1: Information Security Governance, Section: Information Security Policies, Standards, Procedures and Guidelines, Subsection: Information Security Policies, Page 28.