ISACA Certified Information Security Manager Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B1

  Information Security governanace is not the sole responsiblity of the security management team, security program needs to align with business objects. We need executive management to take responsibility for security and drive security with org objectives.

• Chose B2

  This question is testing a fundamental CISM governance principle: Information security governance is the responsibility of executive leadership and the board—not the information security team alone. Although the organization has hired a consulting firm to develop and implement a security framework, executive leadership cannot delegate accountability for governance. If executives believe information security governance is solely the responsibility of the security management team, they are unlikely to: Provide strategic direction, Set risk appetite, Allocate adequate resources, Enforce accountability across the organization, and Integrate security with business objectives. Without executive ownership, even a well-designed framework is unlikely to succeed.

• Chose B3

  Executive leaderschip decides to let senior maangeent focus on runnig the business. Security is part of the business so B.