CISA Question 210

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C3

  Information security policies should be primarily based on a risk management process to ensure that they address the specific threats, vulnerabilities, and impacts relevant to the organization. This approach aligns security controls and policies with the organization's risk appetite and business objectives, making them practical and effective. Why not the others? A. an information security framework – Frameworks (like ISO/IEC 27001 or NIST) guide policy development but do not replace a risk-based approach. B. past information security incidents – While these can inform policies, relying solely on past incidents is reactive, not strategic. D. industry best practices – Best practices provide general guidance, but policies must be tailored based on the organization's unique risk profile.

• Chose A2

  While a risk management process (option C) is essential for identifying and mitigating security risks, information security policies are typically based on established frameworks that incorporate risk management principles as part of their foundation. Therefore, ensuring that policies are defined primarily based on an information security framework ensures alignment with industry best practices and standards, helping to establish a robust and effective information security program.

• Chose C1

  C. a risk management process