ISACA Certified Information Security Manager Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A1

  Why A is correct Effective information security governance depends on security being understood and supported throughout the organization, not just by the information security team. A security-aware corporate culture helps employees and leaders understand their responsibilities, follow policies, recognize risks, and incorporate security into business decisions. That supports governance across the organization. Why the other options are less appropriate B. Advanced security technologies: Technology supports security operations, but sophisticated tools alone don't establish effective governance. C. Periodic vulnerability assessments: Help identify technical weaknesses, but they address only one part of the broader security program. D. Established information security metrics: Metrics help measure performance and inform governance decisions, but measurement alone doesn't ensure organization-wide security awareness and commitment.

• Chose A1

  Metrics tell you if governance is working, and technology helps enforce it, but a security aware culture is the oxygen that actually allows governance to breathe

• Chose A1

  Build the culture first through visible leadership commitment, clear accountability, regular communication, and integration of security into performance expectations. The technologies, assessments, and metrics then become effective instruments rather than expensive decorations. Without the culture, governance remains formal and ineffective.